Created On: 05 October 2009
Problem:
Starting an ASP.NET program can causes a delay of 90 seconds before even the smallest "Hello COBOL world"-program begins execution. This might happen, when the computer has no access to the external internet Microsoft Network Monitor shows that the program vainly tries to access crl.verisign.net on port 80 several times.
Resolution:
The web address crl.verisign.net belongs to the Certificate Revocation List @ VeriSign. The program tries to verify whether its certificate has been revoked or not.
1. A certificate revocation list (CRL) for the site could be manually imported, following:
http://technet.microsoft.com/en-us/library/aa996972(EXCHG.65).aspx
http://www.amug.org/~glguerin/opinion/revocation.html#obtaining
2. Following the description in MSDN:
http://blogs.msdn.com/pfedev/archive/2008/11/26/best-practice-generatepublisherevidence-in-aspnet-config.aspx
or
http://social.msdn.microsoft.com/Forums/en-US/windowssecurity/thread/3c643ee1-f06e-40a4-b253-bd369cb54dc5
The revocation list test can be disabled by setting
in aspnet.config for asp .Net web programs.
The aspnet.config can be found in C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727
See also: http://blogs.msdn.com/dougste/archive/2008/02/29/should-i-authenticode-sign-my-net-assembly.aspx
1. A certificate revocation list (CRL) for the site could be manually imported, following:
http://technet.microsoft.com/en-us/library/aa996972(EXCHG.65).aspx
http://www.amug.org/~glguerin/opinion/revocation.html#obtaining
2. Following the description in MSDN:
http://blogs.msdn.com/pfedev/archive/2008/11/26/best-practice-generatepublisherevidence-in-aspnet-config.aspx
or
http://social.msdn.microsoft.com/Forums/en-US/windowssecurity/thread/3c643ee1-f06e-40a4-b253-bd369cb54dc5
The revocation list test can be disabled by setting
<configuration>
<runtime>
<generatePublisherEvidence enabled="false"/>
</runtime>
</configuration>
in aspnet.config for asp .Net web programs.
The aspnet.config can be found in C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727
See also: http://blogs.msdn.com/dougste/archive/2008/02/29/should-i-authenticode-sign-my-net-assembly.aspx
Incident #2286688
Old KB# 31272