I use Protected Configuration to store sensitive data encrypted in the Web.config file of our asp.net application.
I have followed the steps in Walkthrough: Creating and Exporting an RSA Key Container to generate and export a private key.
I have followed the steps in Walkthrough: Encrypting Configuration Information Using Protected Configuration to encrypt a section of the Web.config file using that key.

My problem is that I am unable to use that key on the test environment, due to strange behaviour from the aspnet_regiis command.

I have been able to get the thing to work on a colleague's computer that runs Windows 8. Both the aspnet_regiis -pi command (importing the private key) and the aspnet_regiis -pa (granting access to the private key) worked without problems there.

On the test environment that runs Windows 7, I have been able to successfully import the private key into the key container using aspnet_regiis -pi <KeyContainer> <KeyFile>.
But when I try aspnet_regiis -pa <KeyContainer> <account-name>, the command just lists it's command line options. It does not indicate failure or success.

All these environments use .Net Framework v4.

I have looked at this question, but the difference is that I was able to execute aspnet_regiis -pi <KeyContainer> <KeyFile>. Nor did it make a difference to execute aspnet_regiis -lk as is suggested there.

The question is: how can I grant the application access to the contents of the Key Container, so that it can decrypt the Web.config? Why is aspnet_regiis acting as if the "-pa" option does not exist, rather than giving me a "Success" or "Failed" message?


It turns out that we were using the wrong version of aspnet_regiis.

We called aspnet_regiis from the %Windows%\Microsoft.Net\Framework\v4.0.30319 directory.
When calling it from %Windows%\Microsoft.Net\Framework64\v4.0.30319, the 64-bit version, the command reported success.

Still, an error message would have been helpful...

It seems that the Key Container is not available unless you have a User Profile. When, on another server, we allowed the account that used "Logon as a Service" to access the Key Container, it failed - even though it was in the Administrator group. When we logged on physically, creating a User Profile in doing so, the Key Container did become available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.