If you’ve ever been frustrated by the length of time it takes to get past the initial pre-logon screen on Citrix Web Interface or Storefront then a simple change can rectify this issue.

Quite often the issue is caused by the web interface or Storefront server making a SSL CRL certificate check to Verisign and if the web interface does not have access to the internet this process will time out. Now whilst its important to allow web based apps and sites to perform CRL checking for financial sites or sites that hold personal data its not really necessary. In order to disable crl checking you need to edit a single file and add a single line of code.

Firstly you need to check which version of ASP your Storefront or Web Interface is using. You can do this by opening the IIS management console and clicking on the application pools. You then right click on the relevent application and basic settings.

Once you know the version delve into C:\windows\microsoft .net/framework\%versionnumber%.

Then edit the aspnet.config and add the line <generatePublisherEvidence enabled="false" /> so that the config file looks like this.

Also change the same aspnet.config in the C:\windows\microsoft .net\framework64\%versionnumber%.

Once saved the changes to the file open up the command prompt and type iisreset to restart IIS and allow the changes to take effect.

Recompile the .Net Application

Even after making the above 2 changes you could still have problems with slow performance on the Web interface site.

On the Web Interface Server, after the sites are configured, run the following command:

C:\windows\microsoft.net\framework\v2.0.50727\aspnet_compiler -v /citrix/xenapp

Where “/citrix/xenapp” is the name of your Web interface site. This will re-compile the .Net application and should fix the issues you are having with slow performance.

Other Note

If the Citrix Web Interface is joined to an LDAP Domain (Active Directory) and there are some IMA Service failed events for Citrix Independent Management Architecture, it probably has problems with the domain account chosen to run the IMA Service and probably even communication with the domain controller.

So, always check domain connectivity from Citrix node and GPO processing (with gpupdate /force command) on the Citrix Web Interface node.