Every year or two, we say to ourselves "Time to encrypt parts of the .config files (that include sql connection strings, etc.)"
Each time we dig in and say "Ouch, machine keys and stuff, that looks hard to manage." Every time we start walking through aspnet_regiis and the encryption chain, we say "how do we manage this across devops, version control, deployment and run time?"
We are now on Win2012-R2. Our .config files live in version control, and are pushed to between two and ten machines (depending on the app in question). Our apps are: asp.net apps under IIS, windows service apps, and (new!) nancy-hosted web servers (basically a windows service). We would like to encrypt several sections.
Is there a direct/simple way to achieve across devops, version control, deployment and run time?? (or an alternative to putting sensitive info in .config files?)