Resolving slow performance or connection errors with the ADSelfService Plus login agent

In this article:

• Issue description
• Possible causes
• Prerequisites
• Resolution
• Validation and confirmation
• How to reach support

Issue description

Users may observe significant delays during the Windows login process or receive the error message Identity server is either unreachable or could not be securely reached after installing the ADSelfService Plus login agent. This issue typically occurs on machines where the login agent attempts to communicate with the ADSelfService Plus server over an SSL-secured connection.

Possible causes

The Local System account on the client machine is unable to access the Certificate Revocation List (CRL) URL over the internet—often due to firewall or proxy restrictions. This typically occurs when the SSL certificate for ADSelfService Plus is issued by a public Certificate Authority (CA), such as GoDaddy, Digicert, or Sectigo, but network policies prevent the client machine from reaching the CA's CRL URL required for certificate validation via the Online Certificate Status Protocol (OCSP).

Prerequisites

• Administrative access to client machines.
• Permissions to modify firewall or proxy settings.

Resolution

1. On the client machine, open the ADSelfService Plus portal in a browser (e.g., https://adss.yourcompany.com:9251).
2. Click the padlock icon in the address bar. Select View certificate and navigate to the Details tab in the Certificate pop-up.
3. Select Authority Information Access and, in the section below, copy the URL value listed under Authority Info Access.
4. Open Command Prompt as an administrator and run the Test-NetConnection command to verify connectivity to the copied URL.
5. If you receive the result TcpTestSucceeded : False, then outbound access to the CRL URL is blocked.
6. In the machine's firewall or Windows proxy/WinHTTP settings, create an allow rule for the identified CRL URL (e.g., http://crl.godaddy.com).

Validation and confirmation

Reboot the affected client machine and attempt to log in to the machine. The delay or error should be resolved, confirming successful SSL certificate validation.

How to reach support

If the issue persists, contact our support team here.