Azure App Service: DNN/Evoq Creates New Web Server Entries and License Appears Inactive (Fixed machineKey Mitigation + “Padding is invalid” Fix)

Solution

Symptoms

• DNN/Evoq intermittently registers a new “Web Server” entry under Persona Bar → Settings → About (Web Servers / License area).
• When the new server entry becomes active, the license is not active on that new entry until you re-activate.
• After setting a fixed <machineKey> in web.config, the site may throw:

Exception: “Padding is invalid and cannot be removed.”

The stack trace often includes entries similar to:

• DotNetNuke.Security.FIPSCompliant.DecryptAES(...)
• DotNetNuke.Professional.Application.ProApplication.CheckLicense()
• ProApplication.get_HasActiveLicenseOrIsTrial()

Why this happens (root cause)

Azure App Service can rotate the underlying worker instance due to platform maintenance/health operations (even when scaling is manual and instance count is 1). This can change environment characteristics used by DNN to identify a server (the server “fingerprint”), leading DNN to treat the runtime as a new server and require license re-activation.

There is no DNN setting that fully prevents Azure worker rotation or guarantees that a new server entry will never appear. The practical approach is to stabilize key fingerprint inputs and use a repeatable recovery procedure when platform events occur.

Recommended mitigation: Use a fixed ASP.NET machineKey

A fixed <machineKey> is not the DNN license key. It is an ASP.NET setting used for encryption/hashing (for example, auth cookies and protected data) and can help keep environment behavior consistent across deployments and slots.

1) Plan and prerequisites

1. Schedule a maintenance window. Changing <machineKey> logs users out and can invalidate existing cookies.
2. Back up the database and take a copy of web.config.

2) Generate strong keys (example: PowerShell on Windows)

Generate:

• 64-byte validation key (128 hex characters) for HMACSHA256
• 32-byte decryption key (64 hex characters) for AES

$valBytes = New-Object byte[] 64
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($valBytes)

$decBytes = New-Object byte[] 32
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($decBytes)

$validationKey = ($valBytes | ForEach-Object { $_.ToString('X2') }) -join ''
$decryptionKey = ($decBytes | ForEach-Object { $_.ToString('X2') }) -join ''

$validationKey
$decryptionKey

3) Add the machineKey to web.config

Place the following under <system.web>:

<machineKey
  validationKey="<validation_key_hex>"
  decryptionKey="<decryption_key_hex>"
  validation="HMACSHA256"
  decryption="AES"
  compatibilityMode="Framework45" />

Important:

• Keep the <machineKey> consistent for the same environment (for example, staging) across deployments and any deployment slots used for that same app.
• Ensure build/deploy transforms do not overwrite or regenerate the <machineKey>.

4) Azure operational settings that help reduce disruption

• Keep Always On enabled.
• Avoid slot swaps/redeploys/restores during critical windows when possible.
• If you intentionally move/replace an instance, deactivate the license on the old server entry before activating on the new one.

Fix: “Padding is invalid and cannot be removed.” after changing machineKey

If the site throws “Padding is invalid and cannot be removed.” immediately after applying the fixed <machineKey>, the stored licensing hash/encrypted data may still be tied to the previous <machineKey> and can no longer be decrypted under the new key.

Step-by-step remediation

1. Do not regenerate the machineKey again. Keep the fixed one in place.
2. Run the following SQL against the DNN site database:

DELETE FROM HostSettings WHERE SettingName = 'hash';

1. Restart the application (Azure App Service restart).
2. Re-activate the license in Persona Bar → Settings → About (Licensing section).

If still failing

As a secondary cleanup step, clear stored Pro license data, then restart and re-activate again:

DELETE FROM DNNPRO_License;

Verification

1. Confirm the site loads and the exception “Padding is invalid and cannot be removed.” is gone.
2. In Persona Bar → Settings → About:
   • Confirm the license shows Activated.
   • Confirm the intended server entry is listed/active.
3. Monitor over time (especially after restarts/platform events) to confirm reduced frequency of “new server” entries and reduced need for manual re-activation.