I wanted to extend my previous efforts of providing a means to encrypt your web.config file without dropping to a command line.  This is mainly for those who are relying on a web hosting provider and can not get access to the command prompt to encrypt the file using the aspnet_regiis.exe command.  So to accomplish my goal I created an admin page that can be used within the BlogEngine.Net administrators pages.  The zip file includes instructions on how to set it up so I won't go through them here.  You can download the extension here.

There are a couple of points worth mentioning:

The web application must have the trust level set to Full.  Now before you start screaming about how bad this is please remember that you can temporarily switch the trust level to full while you encrypt the web.config, and then switch it back to High (slightly better than Full) or Medium (much better) or even low (good luck getting your application to work) once you are done.

The code will automatically handle imbedded .config files.  For example, the default BlogEngine.Net web.config references sql.config for the sql connection strings.  If you select connectionStrings to encrypt then the code will actually encrypt the connection string information in the sql.config file.

If you are running more than one server then you do not want to use this code.  There is an alternative method of encrypting your data that will provide you with a set of RSA keys that can be shared across all of your web farm servers.  See this MSDN article for more information.

I have included the basic list of sections that came to mind during the development of this code.  If you have a custom configuration section that you want to add to the options then you are free to open up the .aspx.cs and add it, or you can send me an email and I will make the change and send it back to you.

Disclaimer

Lastly, I have used this code on most all of my servers without any problems.  If you decide to use this code and something terribly wrong happens to your web.config, then you are on your own.  I will not be held responsible for anything that happens to your web.config file.  Please backup your web.config file (you do perform regular backups on your entire website, right?!) before you run this code just to be sure.

As always, if you run into any trouble or have any questions I will try and do my best to help you out.

Cheers!

Encrypt_Web.Config.zip (3.89 kb)