Using a Server Certificate to Protect Web.Config

Using ASP.NET’s protected configuration feature is recommended when your Web.Config file contains sensitive information.  The .NET Framework gives you two protected configuration providers, DpapiProtectedConfigurationProvider and RsaProtectedConfigurationProvider.  Depending on your application requirements, you can use either of these to get the job done.

You can also create your own protected configuration provider and there is a sample here that shows an implementation using the TripleDESCryptoServiceProvider for encrypting and decryption.  Implementing your own protected configuration provider is simply a matter of writing a class that derives from ProtectedConfigurationProvider.   In this blog post, I’m going to show a another custom provider option using a server certificate for the encryption and decryption.

 

Implement the Provider

Using Visual Studio 2010, create a new Class Library project and inherit your class from ProtectedConfigurationProvider.  The ProtectedConfigurationProvider class is located in the System.Configuration assembly.  So, you will need to add a .NET Reference to System.Configuration and also add a using statement to the top of your class for the System.Configuration namespace.

This provider will perform encryption and decryption using the keys from an X509 Certificate.  The X509Certificate2 class is located in the System.Security assembly.  So, you will need to add a .NET Reference to System.Security and also add a using statement for the System.Security.Cryptography.X509Certificates namespace.  Next, add a private X509Certificate2 member to the class that will be used as a reference to the server certificate.

Read more: Rick Rainey's Blog 

QR: 

Posted via email from Jasper-net