IIS Not Decrypting Password IN AppHost.Config

Question

IIS Not Decrypting Password IN AppHost.Config

rr-4098 2,051

We had to clone one of our web servers for offline testing. Everything worked fine except IIS was not able to decrypt the passwords in the appHost.config. I am not an IIS person, but more of server admin. What is the best way to decrypt all passwords then encrypt them again.

Lex Li (Microsoft) 6,037 Reputation points Microsoft Employee

2023-09-20T00:46:36.2066667+00:00

What exactly was the error you met? Is it IIS or ASP.NET/ASP.NET Core that failed to decrypt the data?
rr-4098 2,051 Reputation points

2023-09-20T03:35:15.11+00:00

Any time I would access the URL for one the hosted sites, the associated App pool would stop and in the event log it stated it was not able to decrypt the password in the apphost.config. I do not recall any mention of .Net . I found this article on how to encrypt the passwords but not how to remove it.

https://learn.microsoft.com/en-us/iis/manage/configuring-security/using-encryption-to-protect-passwords
Lex Li (Microsoft) 6,037 Reputation points Microsoft Employee

2023-09-20T08:53:48.88+00:00

Rephrasing actually made others impossible understand the issue you faced. The right way is to provide the exact error message (even a screen shot).

Besides, open %windir%\system32\inetsrv\config\applicationHost.config and see if you can locate any occurrence of [enc:. If so, like the answer below indicated, you have previously encrypted data (such as passwords) which now cannot be easily decrypted on this machine.

You can reconfigure such settings (like changing application pool identity) and provide new data. Then IIS will encrypt the new data and your web app might start to run well.

3 answers

Your answer

Lex Li (Microsoft) 6,037 Reputation points Microsoft Employee

2023-09-20T00:46:36.2066667+00:00

What exactly was the error you met? Is it IIS or ASP.NET/ASP.NET Core that failed to decrypt the data?
rr-4098 2,051 Reputation points

2023-09-20T03:35:15.11+00:00

Any time I would access the URL for one the hosted sites, the associated App pool would stop and in the event log it stated it was not able to decrypt the password in the apphost.config. I do not recall any mention of .Net . I found this article on how to encrypt the passwords but not how to remove it.

https://learn.microsoft.com/en-us/iis/manage/configuring-security/using-encryption-to-protect-passwords
Lex Li (Microsoft) 6,037 Reputation points Microsoft Employee

2023-09-20T08:53:48.88+00:00

Rephrasing actually made others impossible understand the issue you faced. The right way is to provide the exact error message (even a screen shot).

Besides, open %windir%\system32\inetsrv\config\applicationHost.config and see if you can locate any occurrence of [enc:. If so, like the answer below indicated, you have previously encrypted data (such as passwords) which now cannot be easily decrypted on this machine.

You can reconfigure such settings (like changing application pool identity) and provide new data. Then IIS will encrypt the new data and your web app might start to run well.

Answer 1

Hi @rr-4098,

By default, IIS includes two main providers for securing properties. These providers are located in the applicationHost.config file's <configProtectedData> configuration section and are defined in the <providers> element.

The AesProvider is specific to dealing with encryption and decryption for properties that are in the system.webServer section.

The IISWASOnlyRsaProvider is specific to dealing with encryption and decryption for properties that are in the system.applicationHost section.

These keys are in the iisConfigurationKey and iisWasKey key containers and are machine-specific. In a Web farm scenario, if encryption is required, then a key from one machine - usually the one that created the applicationHost.config file - is exported and brought into the other machines so that secure properties can be decrypted and used by the Web server.

If the original machine still exists, for example the new machine is been cloned to test an upgrade, you can run the export RSA container iisConfigurationKey or iisWasKey on the original server:

aspnet_regiis -px "iisConfigurationKey" c:\temp\iisConfigurationKey.xml -pri

aspnet_regiis -px "iisWasKey" c:\temp\iis\iisWasKey.xml -pri

Then run on the cloned server to import the RSA Container iisConfigurationKey or iisWasKey:

aspnet_regiis -pi "iisConfigurationKey" c:\temp\iisConfigurationKey.xml

aspnet_regiis -pi "iisWasKey" c:\temp\iis\iisWasKey.xml

If importing the RSA Key Container is successful, restart IIS by running: iisreset.

Reference documentation:

Importing and Exporting Protected Configuration RSA Key Containers

Dealing With Machine-specific Encrypted Properties

Creating and Exporting an RSA Key Container

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the email notification for this thread.

Best regards,

Yurong Dai

Answer 2

On my cloned server I checked the %programdata%\microsoft\crypto\RSA folderand found the keys listed with the correct permissions that match the source server. Just to be safe, I exported the RSA keys with the private key and imported them again into the cloned server. The problem is it is hard to test if this is working since the server is offline and will not be able to connect it to the network until off hours on the weekend. If this does not work, I will probably need to create a new RSA container.

https://learn.microsoft.com/en-us/previous-versions/aspnet/yxw286t2(v=vs.100)

Answer 3

rr-4098 2,051

I was able to resolvel my issue by copying the MachineGuid in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography registry location to the target computer. Once I did this, everything worked perfectly. Hopefully this will help someone else going forward. Thanks again for all of the help everyone..

Share via

IIS Not Decrypting Password IN AppHost.Config

3 answers

Your answer