UPDATED: Fix Slow SharePoint 2010 System Performance with the CRL Check

Sometimes you need to install SharePoint 2010 in an environment where the servers do not have an effective Internet connection. This posses a big problem.

Most Microsoft assemblies and DLLs are digitally signed. Each time signed assemblies are loaded, default system behaviour is to check with the owner of the root certificate that the cert with which the assembly was signed is still valid. In the case of Microsoft assemblies, this means “phoning home” to read the Certificate Revocation List at crl.microsoft.com .

Whilst this is all very well and good if you have an Internet connection, sometimes you don’t have this luxury. Many web servers, for instance, don’t have outbound Internet accessibility. The CRL check will attempt to connect to Microsoft’s servers and then timeout, usually within 30-60 seconds.

With SharePoint, you’ll get a lot of delays in this scenario. One way to check if your server is affected by this condition is to open up a SharePoint Management Console PowerShell window and run the “STSADM -help” command. If it takes 30 seconds or more to display the usage instructions, then you will be experiencing really slow server performance.

Disabling the CRL Check

There are three workarounds to this problem, in reverse order of preference:

1. Give your servers an outbound Internet connection
2. Edit the hosts file at “%SYSTEMROOT%\\System32\\drivers\\etc\\hosts” to fool the CRL check into thinking your local machine is crl.microsoft.com by pointing it at 127.0.0.1 (localhost):
   
3. Edit the registry to disable CRL checking by setting the State DWORD to 146944 decimal (SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing for both HKEY_USERS\\.DEFAULT and HKEY_CURRENT_USER) with the following lines of PowerShell:

   #the following statement goes on one line
   set-ItemProperty -path "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion
   \\WinTrust\\Trust Providers\\Software Publishing" 
    -name State -value 146944
   
   #the following statement goes on one line also
   set-ItemProperty -path "REGISTRY::\\HKEY_USERS\\.Default\\Software\\Microsoft
   \\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing" 
    -name State -value 146944
   
   #UPDATED: and the following statement goes on one line too
   get-ChildItem REGISTRY::HKEY_USERS | foreach-object {set-ItemProperty -ErrorAction 
   silentlycontinue -path ($_.Name + "\\Software\\Microsoft
   \\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing") 
   -name State -value 146944}

4. UPDATED: Edit the machine.configs and disable it there. There’s a nice piece of code from the most excellent AutoSPInstaller (autospinstaller.codeplex.com) that does this:

Write-Host -ForegroundColor White " - Disabling Certificate Revocation List (CRL) check..."
ForEach($bitsize in ("","64")) 
{            
  $xml = [xml](Get-Content $env:windir\\Microsoft.NET\\Framework$bitsize\\v2.0.50727\\CONFIG\\Machine.config)
  If (!$xml.DocumentElement.SelectSingleNode("runtime")) { 
    $runtime = $xml.CreateElement("runtime")
    $xml.DocumentElement.AppendChild($runtime) | Out-Null
  }
  If (!$xml.DocumentElement.SelectSingleNode("runtime/generatePublisherEvidence")) {
    $gpe = $xml.CreateElement("generatePublisherEvidence")
    $xml.DocumentElement.SelectSingleNode("runtime").AppendChild($gpe)  | Out-Null
  }
  $xml.DocumentElement.SelectSingleNode("runtime/generatePublisherEvidence").SetAttribute("enabled","false")  | Out-Null
  $xml.Save("$env:windir\\Microsoft.NET\\Framework$bitsize\\v2.0.50727\\CONFIG\\Machine.config")
}

Method 3 is the preferred method, and should have things loading about as quickly as possible. UPDATED: Method 4 is more likely to work, but you’re editing some pretty important files there, so be careful!

UPDATED: You can download a script that combines these methods here: http://static.joelblogs.co.uk/uploads/2012/03/Disable-CRLCheckv2.zip.

As usual, no warranty etc etc, use at your own discretion!