Managed Windows Service starts up slowly after digital signing

Question

We recently tried out digitally signing our .NET binaries. We have a Windows Service which typically starts up within 10 seconds. However after we started digitally signing it, the time increased to around 20-30 seconds. Googling led to me this: http://support.microsoft.com/kb/936707 which basically says that I have to set generatePublisherEvidence to false. But the description of generatePublisherEvidence on MSDN points to the fact that this is not applicable for .NET 4. Still I tried out this setting and it did work. I double checked that my binaries do target .NET 4. Can someone please explain me this behavior?

Accepted Answer

I followed the steps mentioned in http://support.microsoft.com/kb/936707 which basically says that I have to set generatePublisherEvidence to false in my application's App.Config.

Edit: As per ssdi's answer, the root cause of the delay is because:

This problem occurs because the application must download the Certificate Revocation List (CRL) for authentication. However, a lack of network connectivity causes the download to fail by timing out. For example, a firewall may potentially block the download. When Windows first starts, the network connection is not yet initialized.

See also article: http://support.microsoft.com/kb/941990 for more details.

Managed Windows Service starts up slowly after digital signing

Solution

Problem