IBM Support

Slow performance due to Certificate Checking - solved using 'Per Application' approach

Troubleshooting


Problem

Controller client runs abnormally slowly. As part of troubleshooting, the root cause has been found - the .NET certificate checking is failing because the end user does not have access to the internet. [See separate IBM Technote #1347312 for more details]. The customer is aware that one solution is to unticking the "Check for publisher's certificate revocation" setting in Internet Explorer. However, the customer would prefer a solution that does not involve changing the security settings for *all* applications. Is there an alternative solution to this problem?

Symptom

Slow performance symptoms will vary, but typically a customer will find that it takes a long time (for example over a minute) for the Controller client to finish its launch/logon process.

Cause

There are many possible causes for similar slow performance symptoms.

  • For example, see separate IBM Technote #1647468.

This Technote specifically relates to the scenario where the cause is that the end user's client device cannot access internet, which causes the certificate checking process to hang. This delays the start/execution of the Controller client.
  • For more details, see separate IBM Technote #1347312.

Environment

The client device (where the Controller CCR.EXE client is actually running) does not have the ability to contact/reach the Internet, in order to check software certificates.

  • Typically this is because the Controller client is being run on a Citrix or Terminal Server.

Diagnosing The Problem

Disable "Check for publisher's certificate revocation" setting in Internet Explorer - if performance greatly improves, then this proves that certificate checking is the cause.

  • For more details, see separate Technote #1347312.

Resolving The Problem

There are several alternative methods that are available to solve the problem.

  • See separate Technote #1347312 for more methods

This Technote specifically relates only to the solution where the customer's preferred solution is to configure the end user's client device to not perform the certificate check on a per-application basis.

Specifically, configure the following two applications to not perform the certificate check:
(1) Controller client (ccr.exe)
(2) Microsoft Excel (excel.exe)
  • TIP: Afterwards, to improve performance even further, *also* perform the steps outlined in separate Technote #1647468.

Steps:
===========================================
PART ONE - Excel
  1. Logon to the client device
  2. Open the folder where Excel is installed (for example: C:\Program Files (x86)\Microsoft Office\Office14)
  3. Locate the file "excel.exe.config"
  4. Open this file inside NOTEPAD.EXE
  5. Add some extra information (highlighted in bold below) so it looks something similar to:
    <configuration>
    <startup>
    <supportedRuntime version="v2.0.50727"/>
    </startup>
    <runtime>
    <generatePublisherEvidence enabled="false"/>
    </runtime>
    </configuration>

6. Save and close
===========================================
PART TWO - Controller
The steps vary slightly, depending on what Controller client has been installed.
  • TIP: For a description of the different Controller clients, see separate IBM Technote #1371088 .

CCRLocalClient.MSI (also known as using the 'local client').

    In this scenario, the Controller client is launched from the PC's local hard drive.
    TIP: Below are the default locations for this file:
    • Controller 10.1.x or 10.2.x on 64-bit OS: C:\Program Files (x86)\IBM\IBM Cognos Controller
    • Controller 10.1.x or 10.2.x on 32-bit OS: C:\Program Files\IBM\IBM Cognos Controller
    • Controller 8.x on 32-bit OS: C:\Program Files\Cognos\ccr

    1. Logon to the client device
    2. Browse to the folder where the Controller client have been installed (see above)
    3. Locate the file "CCR.exe.config", and open it inside NOTEPAD.EXE

    4. Add the following extra information into the file.

    <runtime>
    <generatePublisherEvidence enabled="false"/>
    </runtime>

    NOTE: these three lines should be added JUST BEFORE the final line (which should be "</configuration>"). In other words, the file will look similar to:

    .........
    .........
    .........
    <runtime>
    <generatePublisherEvidence enabled="false"/>
    </runtime>
    </configuration>

    5. Save and Test.
    6. Ideally, for most customers it is recommended to now *also* perform the steps outlined in separate Technote #1647468.

-------------------------------------------------------------------------
ControllerClient.MSI (also known as the 'web client')
    In this scenario, the Controller is launched directly from the website (for example http://servername/ibmcognos/controllerbin/ccr.exe )

    The file that you need to modify is: CCR.exe.config

    TIP:
    • This is located on the web server (typically the Controller application server).
    • The default location of this file will vary (depending on version of Controller)
    EXAMPLE: C:\Program Files (x86)\IBM\cognos\c10\webcontent\ccr\CCR.exe.config
-------------------------------------------------------------------------

[{"Product":{"code":"SS9S6B","label":"IBM Cognos Controller"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Controller","Platform":[{"code":"PF033","label":"Windows"}],"Version":"10.2.1;10.2.0;10.1.1;10.1;8.5.1;8.5;8.4;8.3","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
15 June 2018

UID

swg21441779

Page Feedback