Created On:  05 October 2009

Problem:

Starting an ASP.NET program can causes a delay of 90 seconds before even the smallest "Hello COBOL world"-program begins execution. This might happen, when the computer has no access to the external internet Microsoft Network Monitor shows that the program vainly tries to access crl.verisign.net on port 80 several times.

Resolution:

The web address crl.verisign.net belongs to the Certificate Revocation List @ VeriSign. The program tries to verify whether its certificate has been revoked or not.

1. A certificate revocation list (CRL) for the site could be manually imported, following:

http://technet.microsoft.com/en-us/library/aa996972(EXCHG.65).aspx
http://www.amug.org/~glguerin/opinion/revocation.html#obtaining

2. Following the description in MSDN:

http://blogs.msdn.com/pfedev/archive/2008/11/26/best-practice-generatepublisherevidence-in-aspnet-config.aspx
or
http://social.msdn.microsoft.com/Forums/en-US/windowssecurity/thread/3c643ee1-f06e-40a4-b253-bd369cb54dc5

The revocation list test can be disabled by setting

<configuration>
    <runtime>
        <generatePublisherEvidence enabled="false"/>
    </runtime>
</configuration>

in aspnet.config for asp .Net web programs.

The aspnet.config can be found in C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727

See also: http://blogs.msdn.com/dougste/archive/2008/02/29/should-i-authenticode-sign-my-net-assembly.aspx

Incident #2286688