Encrypt Web.config Using aspnet_regiis.exe

Question

We are developing our first website by asp.net mvc. You know every asp.net project has "web.config" file that Contains sensitive configuration parametersو like connectionStrings (username and password for connecting to database). Now, for improving security of our web site and avoid hacking, we want to encode or encrypt the content of web.config file. We followed according to https://www.codeproject.com/Tips/877258/How-to-Encrypt-Web-config-Using-aspnet-regiis-exe. At localhost, web.config is encoded as well and loading web site is ok. but when we uploaded our site on the server, The site was loaded with this error: "An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine."

What is the problem? May you help me? Best Regards

Answer 1

You missed the following point.

This method depends on the machine where you originally encrypted the data, for example if machine A encrypts “hello world”, only machine A has the right keys to decrypt it. This result in a non-suitable solution when working with web farms.

You need to encrypt your config file in the server it self. You can't copy a config file which has been encrypted somewhere else (some other machine). Encryption & Decryption is specific to the machine.