Certificate Authentication via IIS is painfully slow

[solarding]

I tried my new API project with .netCore 3.1, where Client Certiticate Authentication is needed.
According to official recommendations, the validation/trust check is done in IIS, and the authorization is done in my code
OnCertificateValidated = context => {...}

I did exactly what "Configure certificate authentication" says, however the performance is a disaster.

The process of IIS cert. validation takes 10 to 15 secs. And the IIS does it every 1 or two minutes.
I see there is an option in the .net 5 previews called AddCertificateCache().
Does anymore know if this cache option is helpful? or it only affects cert. validation throug Kestrel or also IIS? Should I ask the IIS team?

[solarding]

[Tratcher]

ASP.NET Core doesn't treat client certificates any differently at the IIS layer. The only addition is the middleware. If you remove the middleware do you still see an issue?

[solarding]

I do not understand where is the middleware that I can remove.
The code I'm using is from MS Document Configure certificate authentication in ASP.NET Core
It is the eventhandler OnCertificateValidate got invoked very slow, comes in very late, it took a lot of time doing whatever it needs to do before calling this back

services.AddAuthentication(
    CertificateAuthenticationDefaults.AuthenticationScheme)
    .AddCertificate(options =>
    {
        options.Events = new CertificateAuthenticationEvents
        {
            **OnCertificateValidated** = context =>
            {
                var validationService = context.HttpContext.RequestServices.GetService<ICertificateValidationService>();
                if (validationService.ValidateCertificate(context.ClientCertificate))
                {                   
                    context.Success();
                }           
                return Task.CompletedTask;
            }
        };
    });

[Tratcher]

I meant if you temporarily comment out all of the code you just showed there is the app still slow when it receives client certificates? I know the auth won't work without it, I just want you to test the server layer in isolation.

I'm assuming this is not an AspNetCore server issue, but an issue with AddCertificate. Note that AddCertificate's options include many settings that may affect the performance. You should try adjusting them to see which ones make it slow. Start with RevocationMode, that's a common performance bottleneck.

[solarding]

Thanks Tratcher, it is the RevocationMode of CertificaeAuthenticationOption, default "online" was the perf. killer.

[Tratcher]

That probably means the server doesn't have direct internet access and is timing out on that check. At least now you know what to investigate.