Home / server / Questions / 477660
Accepted
S.L. Barth
Asked: 2013-02-12 08:08:16 +0800 CST

"aspnet_regiis -pa" doesn't work

  • 772

I use Protected Configuration to store sensitive data encrypted in the Web.config file of our asp.net application.
I have followed the steps in Walkthrough: Creating and Exporting an RSA Key Container to generate and export a private key.
I have followed the steps in Walkthrough: Encrypting Configuration Information Using Protected Configuration to encrypt a section of the Web.config file using that key.

My problem is that I am unable to use that key on the test environment, due to strange behaviour from the aspnet_regiis command.

I have been able to get the thing to work on a colleague's computer that runs Windows 8. Both the aspnet_regiis -pi command (importing the private key) and the aspnet_regiis -pa (granting access to the private key) worked without problems there.

On the test environment that runs Windows 7, I have been able to successfully import the private key into the key container using aspnet_regiis -pi <KeyContainer> <KeyFile>.
But when I try aspnet_regiis -pa <KeyContainer> <account-name>, the command just lists it's command line options. It does not indicate failure or success.

All these environments use .Net Framework v4.

I have looked at this question, but the difference is that I was able to execute aspnet_regiis -pi <KeyContainer> <KeyFile>. Nor did it make a difference to execute aspnet_regiis -lk as is suggested there.

The question is: how can I grant the application access to the contents of the Key Container, so that it can decrypt the Web.config? Why is aspnet_regiis acting as if the "-pa" option does not exist, rather than giving me a "Success" or "Failed" message?

asp.net

1 Answers

  1. Best Answer

    It turns out that we were using the wrong version of aspnet_regiis.

    We called aspnet_regiis from the %Windows%\Microsoft.Net\Framework\v4.0.30319 directory.
    When calling it from %Windows%\Microsoft.Net\Framework64\v4.0.30319, the 64-bit version, the command reported success.

    Still, an error message would have been helpful...

    EDIT:
    It seems that the Key Container is not available unless you have a User Profile. When, on another server, we allowed the account that used "Logon as a Service" to access the Key Container, it failed - even though it was in the Administrator group. When we logged on physically, creating a User Profile in doing so, the Key Container did become available.

    • 3