Every year or two, we say to ourselves "Time to encrypt parts of the .config files (that include sql connection strings, etc.)"

Each time we dig in and say "Ouch, machine keys and stuff, that looks hard to manage." Every time we start walking through aspnet_regiis and the encryption chain, we say "how do we manage this across devops, version control, deployment and run time?"

We are now on Win2012-R2. Our .config files live in version control, and are pushed to between two and ten machines (depending on the app in question). Our apps are: asp.net apps under IIS, windows service apps, and (new!) nancy-hosted web servers (basically a windows service). We would like to encrypt several sections.

Is there a direct/simple way to achieve across devops, version control, deployment and run time?? (or an alternative to putting sensitive info in .config files?)


Take a look at Vault from Hashicorp.


It is an increasingly commonly deployed solution to the problem of secrets management in a devops/configuration management context, and it runs on Windows.

  • Does Vault handle secrets in .net config files , in a super easy or transparent way? (Transparent to the app consuming the config) – samsmith Aug 28 '16 at 4:25
  • Well, Vault handles the hard part of ensuring that secrets are safely stored and distributed throughout an infrastructure, but the specific mechanisms for injecting them into application configuration appropriately have to be done by the application. The most common practice is to have the application know that configuration point X is a secret and should be pulled in using a secrets provider, which can then be bound to vault. When adding new secrets, this pattern can be reused. – Jonah Benton Aug 29 '16 at 8:56
  • Thx. Vault is interesting, but this is not a direct answer to the q – samsmith Aug 29 '16 at 14:30
  • 1
    Vault is an alternative to putting sensitive infomation in config files, which is one of the requested requirements.. Encrypted file systems are a transparent solution. Neither is simple nor direct. I wonder if simple/direct may describe any solution involving encryption or sensitive information. – Jonah Benton Aug 29 '16 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.