Article ID: 272228
Article Last Modified on 12/3/2007
APPLIES TO
- Microsoft Internet Information Services 5.0
- Microsoft Internet Information Services 6.0
This article was previously published under Q272228
SYMPTOMS
When you first attempt to connect (first request) to an Internet Information Services (IIS) computer, a delay of 20 to 30 seconds occurs when the Web browser is initiating an SSL connection.
CAUSE
When IIS receives an incoming SSL request from a client, it attempts to build its certificate chain before sending its certificate information back to the client. During this time, if the IIS computer does not have the issuing Certificate Authority's Root certificate installed locally, it tries to connect to the Certificate Authority directly to obtain it. This causes the server to try and resolve the certificate authority's machine name or fully qualified domain name to an IP address.
If the Certificate Authority (Certificate Server) is inaccessible from the IIS computer, then IIS keeps trying to resolve the Certificate Authority's IP address until it times out. These name resolution queries cause the SSL connection to delay.
WORKAROUND
To work around this issue, you need to manually install the Certificate Authority's root certificate to the IIS server's local computer "Trusted Certificate Authorities" (Root) certificate store. To do this, perform the following steps:
- Download the Certificate Authority Root certificate to the desktop.
- Right-click the Root certificate, and then click Install Certificate.
- Click Next, and then choose Place all certificates in the following store.
- Click Browse, and then click to select the Show Physical Stores check box.
- Click to expand Trusted Root Certification Authorities.
- Click Local Computer, and then click OK.
The Certificate Store location should be Trusted Root Certification Authorities\Local Computer.
- Click Next, and then click Finish.
- In theThe Import was successful dialog box, click OK.
The initial connection time should now be much faster.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
Additional query words: iis 5 iis5 iis 6 iis 6.0 iis6 ssl delay hang
Keywords: kbbug kbpending KB272228
