Migrating MachineKey from iis6 on old server to iis7 on new server

Question

I am migrating our hosting environment to a totally new data center with new boxes and hardware and software... the whole deal.

Our website cookies are encrypted using the machineKey, so when I make a request to my domain and point it to the new web server (by overriding the local hosts file), I get an error because the cookie cannot be decrypted, since the Machine Key is different. I'd like to avoid any problems a frequent user might have when they arrive at the new server for the first time.

To the best of my knowledge, at this point I think I need to set the same MachineKey from our current servers on our new servers. This way when past visitors with a cookie arrive at our website served by the new server, the cookie will be decrypted properly with the MachineKey it was encrypted with and then log them in properly.

My question is where do I find my MachineKey value (in IIS 6 win2k3 server) so I can use that value to set it statically on my new servers? I've pulled up my machine.config file, but it doesn't specify the key, it only specifies a configSection where the key can be defined. It's not in my web.config for the app or elsewhere.

I did find this great article on some MachineKey and Web Garden woes (which could explain some other bugs I've been experiencing with regard to the machineKey).

Update I am back to this issue and am still faced with a similar problem. I have the MachineKey auto-generated on the IIS6 server but I need to get that exact key so I can set it explicitly and not have it auto-generated anymore.

Any help is appreciated...

Answer 1

MaseBase, have you seen this question with answers on Stack overflow at ASP.NET migration

Answer 2

Have you seen this?

Looks like you can retrieve it by looking at

• System.Web.Configuration.MachineKeySecion.DecryptionKeyInternal and
• System.Web.Configuration.MachineKeySecion.ValidationKeyInternal

These are internal however, so you'll have to use reflection.

Answer 3

There are two machineKeys that you can use. I am not sure which one you are using to encrypt. But here are the two machinekeys anyways...

1. C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys
2. http://support.microsoft.com/kb/312906. You shouldn't keep it as AutoGenerate, else the machineKeys will be autogenerated on all the machines and hence, it would be different.

HTH, Rahul