# Designer startup : Verifying Signature of Designer **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [December 4, 2023, 4:27pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670 "2023-12-04T16:27:35Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Jean-Maurice\_Dubois](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jean-maurice_dubois/32/80996_2.png) [@Jean-Maurice\_Dubois](https://forum.inductiveautomation.com/u/Jean-Maurice_Dubois)\ **Post date:** [December 4, 2023, 4:27pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/1 "2023-12-04T16:27:35Z")
Since upgrade to version 8.1.34, on my ot network (with no internet connection) my designer takes longer to open because of this message: Verifying Signature of Designer ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/c/6c8236f985d831c8c9fb60e78af879907d7ce96c.png) Any idea what is causing this? Even if I configure a non https connection to the gateway, samething. So it doesn't seems to be related to certificates. Thanks ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 4, 2023, 4:33pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/2 "2023-12-04T16:33:53Z")
I believe this is the new signature verification security measure... basically we're now cryptographically verifying that the executable bootstrap JAR the launcher downloads from the gateway is unmodified and signed by IA. What kind of hardware are you experiencing this delay on and how long is it? @jcoffman probably has more details. ---
**Author:** ![Jean-Maurice\_Dubois](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jean-maurice_dubois/32/80996_2.png) [@Jean-Maurice\_Dubois](https://forum.inductiveautomation.com/u/Jean-Maurice_Dubois)\ **Post date:** [December 4, 2023, 4:40pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/3 "2023-12-04T16:40:50Z")
Ok, I understand. It's on a vsphere with 32 virtual processor Xeon 5315Y Gold 3.20Ghz, 64 GB Ram. (that the vm that the designer is running on) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 4, 2023, 4:41pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/4 "2023-12-04T16:41:59Z")
> [@Jean-Maurice\_Dubois](#): > > with no internet connection I think this is probably the cause of the delay. There will be an attempt to check for certificate revocations, and you're probably running up against a timeout. The failure is soft, though, and that's why you can continue to launch. ---
**Author:** ![Jean-Maurice\_Dubois](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jean-maurice_dubois/32/80996_2.png) [@Jean-Maurice\_Dubois](https://forum.inductiveautomation.com/u/Jean-Maurice_Dubois)\ **Post date:** [December 4, 2023, 4:43pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/5 "2023-12-04T16:43:44Z")
Yes, that was my first impression since my gateway in the IT network with internet has no issues. ---
**Author:** ![jcoffman](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jcoffman/32/6429_2.png) [@jcoffman](https://forum.inductiveautomation.com/u/jcoffman)\ **Post date:** [December 4, 2023, 4:52pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/6 "2023-12-04T16:52:46Z")
Kevins statement is correct. there is a timeout with a soft fail if revocation checks fail. This may result in a slight delay when launching, but shouldn't prevent launches. ---
**Author:** ![Jean-Maurice\_Dubois](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jean-maurice_dubois/32/80996_2.png) [@Jean-Maurice\_Dubois](https://forum.inductiveautomation.com/u/Jean-Maurice_Dubois)\ **Post date:** [December 4, 2023, 6:36pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/7 "2023-12-04T18:36:27Z")
OK, but it's annoying. Are industrial networks more and more without internet access? I find it bizarre (like the projects template not being available) because of lack of internet. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 4, 2023, 6:53pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/8 "2023-12-04T18:53:11Z")
> [@Jean-Maurice\_Dubois](#): > > Are industrial networks more and more without internet access? Less and less, in reality... ---
**Author:** ![jcoffman](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jcoffman/32/6429_2.png) [@jcoffman](https://forum.inductiveautomation.com/u/jcoffman)\ **Post date:** [December 4, 2023, 6:53pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/9 "2023-12-04T18:53:12Z")
I understand the slight delay can be frustrating, but this provides a robust industry-standard way to verify the authenticity of jars downloaded over the internet. the soft-fail mechanism is the default we use specifically because most launch cases are on networks without internet access. The "strict" mode would actually require a connection to one of the revocation endpoints ([ocsp.digicert.com](http://ocsp.digicert.com) or [cacerts.digicert.com](http://cacerts.digicert.com)) which is why its not the default (but can be turned on in the launchers' config JSON) You could get with IT to allow comms to the OCSP server if its a blocker, but typically this type of thing wouldn't be a "blocker" but an annoyance and the trade-off for security here is a much higher need than the delay in launching, especially considering its a fixable problem with modern IT solutions. ---
**Author:** ![Jean-Maurice\_Dubois](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jean-maurice_dubois/32/80996_2.png) [@Jean-Maurice\_Dubois](https://forum.inductiveautomation.com/u/Jean-Maurice_Dubois)\ **Post date:** [December 4, 2023, 7:12pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/10 "2023-12-04T19:12:54Z")
I agree also for the security reasons. I will check with IT if they are willing to let that connection pass threw the firewall. Thanks ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [January 7, 2024, 3:35pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/11 "2024-01-07T15:35:45Z")
I'm guessing there's no way to disable this? Is there a way to shorten the timeout? This took about 1:15 on an OT network of one of our clients. About 1/2 the time is the progress bar "bouncing" back and forth, then the 2nd half is solid gray progress bar, so not sure if there's 2 parts to the verification, but this more than what I would call a slight delay. If this can have a shorter timeout it would help for networks without internet access (I haven't tested this on Edge, but assume the time would be the same), but we've been trying to push this as a PanelView replacement and many of these won't have internet at all, and this delay on a restart of the system just slows things down. Is it possible to package a cached and encrypted set of verified signatures with the gateway so that it can do a failover to the cached copy on the local network? This would still allow for signature verification to speed this up even more. Unless someone got ahold of your private key, it should still be secure. Maybe not make it default, but allow a launcher parameter to set it to default to local verification or shorten the timeout before failover or even shorten the soft fail. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 7, 2024, 3:40pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/12 "2024-01-07T15:40:36Z")
Consider having your isolated network resolve the domain names to addresses that exist, but have no web server, and are configured to actively reject the connections (REJECT instead of DROP in any firewall rules). I would expect that to short-circuit the timeouts. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 7, 2024, 3:44pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/13 "2024-01-07T15:44:00Z")
> [@pturmel](#): > > I would expect that to short-circuit the timeouts. Yes, something like this would help. > [@michael.flagler](#): > > Is it possible to package a cached and encrypted set of verified signatures with the gateway so that it can do a failover to the cached copy on the local network? No, it's not signature verification itself that is taking a long time, it's certificate revocation checking, which can't be cached. It's timing out trying to contact the OCSP server and the way this network is setup must be causing it to be passively rejected rather than actively rejected, as Phil suggested. Maybe we can add an option to the launcher config to disable revocation checking, but it wouldn't be enabled by default. ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [January 7, 2024, 3:58pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/14 "2024-01-07T15:58:59Z")
I just added the following lines to the hosts file of the computer running the designer/client for Windows and this sped it up to only taking 30 seconds which is much less bothersome now. ```auto 127.0.0.1 ocsp.digicert.com 127.0.0.1 cacerts.digicert.com ``` ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 7, 2024, 4:00pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/15 "2024-01-07T16:00:54Z")
You might want to use wireshark to see if it is trying some additional domain name. I would expect the delay to go to zero if you get them all. ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [January 7, 2024, 4:42pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/16 "2024-01-07T16:42:09Z")
Did a wireshark capture on DNS queries, and found a couple more. In fact, I didn't see it reach out to [cacerts.digicert.com](http://cacerts.digicert.com), so removed it. There's also info here on what domains and IPs DigiCert uses: [New Dedicated IP Addresses](https://knowledge.digicert.com/alerts/new-dedicated-ip-addresses) Here's the final lines added to the hosts file on Windows to make this instantly fail (only pops up for a fraction of a second now). ```auto 127.0.0.1 ocsp.digicert.com 127.0.0.1 crl3.digicert.com 127.0.0.1 crl4.digicert.com ``` ---
**Author:** ![klpe](https://avatars.discourse-cdn.com/v4/letter/k/59ef9b/32.png) [@klpe](https://forum.inductiveautomation.com/u/klpe)\ **Post date:** [January 18, 2024, 8:35am UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/17 "2024-01-18T08:35:45Z")
Has anyone looked into the Windowsregistry if you can turn off the check? I did a quick check but could not find an option for it in HKEY\_LOCAL\_MACHINE\SOFTWARE\Inductive Automation\Ignition My system is also on an isolated network, with multiple clients on different locations, so I'm not fond of the idea of modifing the host file. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 18, 2024, 1:03pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/18 "2024-01-18T13:03:54Z")
> [@klpe](#): > > so I'm not fond of the idea of modifing the host file. Then place a DNS server in the isolated network to give the necessary responses. ---
**Author:** ![tgish](https://avatars.discourse-cdn.com/v4/letter/t/34f0e0/32.png) [@tgish](https://forum.inductiveautomation.com/u/tgish)\ **Post date:** [January 18, 2024, 9:56pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/19 "2024-01-18T21:56:45Z")
Really glad I found this post. This delay on start up is brutal. I can't imagine there are very many systems with internet access...we're already struggling to get buy in and an almost 2 minute delay is a hard sell. Hopefully the DNS entries here will help us out. ---
**Author:** ![klpe](https://avatars.discourse-cdn.com/v4/letter/k/59ef9b/32.png) [@klpe](https://forum.inductiveautomation.com/u/klpe)\ **Post date:** [January 19, 2024, 9:23am UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/20 "2024-01-19T09:23:13Z")
Thanks pturmel, I will look into that. [Next page](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670.md?page=2)