MSDeploy automatic encryption of connection strings, key not found in dictionary

Question

Since Web Deploy 3.5 automatic encryption of connection strings is supported using the flag: –EnableRule:EncryptWebConfig. However, upon running it with:

"C:\Program Files\IIS\Microsoft Web Deploy V3\msdeploy.exe" -source:package='C:\[...]\MyApp.WebDeployPackage.zip' -dest:auto,includeAcls="False" -verb:sync -disableLink:AppPoolExtension -disableLink:ContentExtension -disableLink:CertificateExtension -setParamFile:"C:\[...]\MyApp.SetParameters.xml" -EnableRule:EncryptWebConfig  -verbose

I get:

Error Code: ERROR_FAILED_TO_ENCRYPT_WEB_CONFIG
More Information: Failed to encrypt destination web.config: C:\[...]\Web.config.  
Learn more at: http://go.microsoft.com/fwlink/?LinkId=221672#ERROR_FAILED_TO_ENCRYPT_WEB_CONFIG.
Error: The given key was not present in the dictionary.

The Learn more-link points to dated documentation, and I can't seem to find any info online.

I suspect the tool is using aspnet_regiis behind the scenes, but I'm not sure. Yes, I'm running the above with full Admin-rights.

Revert

I was deploying to windows server 2008 and didn't get any error, even when using the verbose parameter. It just didn't encrypt the connection string. Deploying the same package to a 2012 server I received the error. Just an FYI to those deploying to 2008 and IIS 7.5. – Rictus

Answer 1

I had the same problem, but it wasn't due to a nested web.config file. Turns out for some reason my deploy user wasn't able to access the key container (in the Web Deployment Service error logs, the exception thrown was System.Configuration.ConfigurationErrorsException: The RSA key container could not be opened. ).

I ended up using this command: aspnet_regiis -pa "NetFrameworkConfigurationKey" "<MYUSER>" to give <MYUSER> the necessary access.

Hearten

Answer 2

I had the same issue, took me a while to find out the fix - uninstalling Web Deploy (via Add/Remove Programs) and installing again (via Web Platform Installer) did the trick.

To make it easier for others to read actual errors - they are recorded in System Event Logs, you need to navigate down the tree and expand applications and down to Web Deploy.

Lonni

Answer 3

I got the same issue due to having nested web.config files.

This appears to be a bug in the EncryptWebConfig rule.

You can work around this issue if you can manage with just a root web.config.

Cozen

By nested Web.config, do you mean one file in the root, and one file inside the Views-directory for example? (Or other directory if not ASP.NET MVC.) – Revert

Yes, that is it exactly! – Cozen

I deleted the /Views/web.config but still get the same problem. – Weimer

Has anyone figured out how to fix MSDeply with EncrypWebConfig? Added aspnet_regiis -pa "NetFrameworkConfigurationKey" "UserId" - but no luck. Anyone know how to diagnose the error – Mcmanus

I have the same problem with deploying to a sub-folder of the default web site. I get the ERROR_FAILED_TO_ENCRYPT_WEB_CONFIG message. If I deploy to the Default Web Site, it will encrypt, but only if the web.config is already there. In other words it won't encrypt on the first deployment, but will on subsequent. – Rictus

Answer 4

installing web deploy 3.6 on the server from the web platform installed fixed my problem

Lanie

What problem? Are you saying that you had the exact same issue as reported here? If so, we'd ideally like you to say so in the Answer. See How to Answer. – Threnody

Answer 5

I had the exact same issue, uninstalling Web Deploy 3.5 (using "Add/Remove Programs"), restart the machine, and then reinstalling Web Deploy 3.6 (using Microsoft Web Platform Installer) fixed this issue.

Please note the version upgrade from 3.5 to 3.6.

Graniah