KB0015 - Offline PSU server has slow dashboards

KB0015 - Offline PSU server has slow dashboards

Disclaimer

Please be careful with changing any settings on your server around the Certificate Revocation List. You should only do this if you know what you are doing. Read the related Github articles (linked below) in their entirety.

Symptom

PSU servers that are disconnected from the internet (offline) have slow dashboard start-up times.

Root Cause

PowerShell Core is attempting to download the Certificate Revocation List from Microsoft and is timing out

Related Links


Workaround #1 (confirmed)

You can reduce the timeout value for the Revocation List check to 1 second by modifying the registry keys per below PowerShell script. After applying, restart the PowerShell Universal service or IIS web site.

Only enable these settings if your machine isn't exposed to the Internet or doesn't have access to a Certificate Revocation List! Please also keep in mind that this is not a global solution. The problem with CRL checking is different from application to application, from server to server! Please also always think about how to provide your servers with the latest root certificates as well as an up-to-date Certificate Revocation List.

# Create the keys if missing 
If((Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine') -eq $false ) { New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine' -Force -ErrorAction SilentlyContinue }
If((Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine\Config') -eq $false ) { New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine\Config' -Force -ErrorAction SilentlyContinue }

# Set Timeout values to 1 second (1000 ms)
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine\Config" -Name ChainUrlRetrievalTimeoutMilliseconds -Value 1000 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine\Config" -Name ChainRevAccumulativeUrlRetrievalTimeoutMilliseconds -Value 1000 -PropertyType DWORD -Force

Workaround #2 (unconfirmed)