# Designer startup : Verifying Signature of Designer **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [December 4, 2023, 4:27pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670 "2023-12-04T16:27:35Z")\ **Posts on this page:** 12\ **Page:** 2
**Author:** ![mahsasalimi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mahsasalimi/32/68520_2.png) [@mahsasalimi](https://forum.inductiveautomation.com/u/mahsasalimi)\ **Post date:** [March 27, 2024, 9:55am UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/21 "2024-03-27T09:55:54Z")
I am experiencing the same thing, no internet connection and self signed certificate. I disabled the "Check for server certificate revocation" in the AD and it still takes noticeable amount of time to open the designer . ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 27, 2024, 11:18am UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/22 "2024-03-27T11:18:03Z")
> [@mahsasalimi](#): > > in the AD That has no effect on Ignition. ---
**Author:** ![Hamish\_Dodd](https://avatars.discourse-cdn.com/v4/letter/h/73ab20/32.png) [@Hamish\_Dodd](https://forum.inductiveautomation.com/u/Hamish_Dodd)\ **Post date:** [April 3, 2024, 10:23pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/23 "2024-04-03T22:23:20Z")
Thanks Michael, this was really helpful for preventing the popup when launching client apps on the gateway machine. I've done the same on some other machines, but this doesn't seem to prevent the popup hanging when launching clients on these devices. I've had a look at the DNS traffic and have only seen [ocsp.digicert.com](http://ocsp.digicert.com) and [crl14.digicert.com](http://crl14.digicert.com), so I would think they'd be prevented by those lines in the host file but evidently not. Have you experienced similar? ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [April 3, 2024, 10:28pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/24 "2024-04-03T22:28:38Z")
I haven't, but I did notice in today's nightly release notes for 8.1.40 that they're adding an option for the designer launcher to specify how this should be handled so that air gapped systems can bypass the CRL check that hangs things up. The only other thing I would suspect is if the port/URL it reaches out to check is listening on your localhost, then it could be waiting on it to timeout/return something. ---
**Author:** ![wdougmiller](https://avatars.discourse-cdn.com/v4/letter/w/a9a28c/32.png) [@wdougmiller](https://forum.inductiveautomation.com/u/wdougmiller)\ **Post date:** [May 15, 2024, 9:50pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/25 "2024-05-15T21:50:55Z")
**edit** i may be misinterpreting your response to Jean's question. i took your reply to mean more ICS have internet access and used the context of this feature needing that access to check for cert revocations to come to that conclusion. I disagree with this statement. There is a big difference in Industrial Control Systems building in secure access for isolated systems to have specific internet access and industrial network as a whole having access to the internet. Ignition is built for industrial systems. Please tell me you didnt just build in a requirement for internet that without it...creates a long delay. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 15, 2024, 9:55pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/26 "2024-05-15T21:55:12Z")
You can disagree all you want. More power to you. It doesn't change what I observe through my work with our support department. There's a way to opt out of the OCSP verification starting in 8.1.40. It's only necessary if the network is configured such that the outbound traffic is blackholed instead of the connection explicitly failing. > **[Launchers and Workstation | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/launchers-and-workstation#signature-verification)** > > Ignition features several launchable runtimes ---
**Author:** ![wdougmiller](https://avatars.discourse-cdn.com/v4/letter/w/a9a28c/32.png) [@wdougmiller](https://forum.inductiveautomation.com/u/wdougmiller)\ **Post date:** [May 15, 2024, 10:23pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/27 "2024-05-15T22:23:09Z")
\*\*im staring at the delayed signature right now observations aside. can you clarify something for me. are you saying that Ignition designer now has a delay in start up due to the inability to reach the internet? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 15, 2024, 10:27pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/28 "2024-05-15T22:27:19Z")
> [@wdougmiller](#): > > are you saying that Ignition designer now has a delay in start up due to the inability to reach the internet? This is now a possibility depending on your network configuration unless you opt out of the security measures by using the new `AIR_GAPPED` or `LOOSE` values for the `signature.verification.strength` key in the launcher config. It's not like we intentionally set out and made this decision but it's a consequence of how modern PKIX and code signing work. ---
**Author:** ![wdougmiller](https://avatars.discourse-cdn.com/v4/letter/w/a9a28c/32.png) [@wdougmiller](https://forum.inductiveautomation.com/u/wdougmiller)\ **Post date:** [May 15, 2024, 10:29pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/29 "2024-05-15T22:29:44Z")
Thanks for quick response and info on 8.1.40. As to your customer networks with broad internet access. Oof. Not good. ---
**Author:** ![19tb21](https://avatars.discourse-cdn.com/v4/letter/1/0ea827/32.png) [@19tb21](https://forum.inductiveautomation.com/u/19tb21)\ **Post date:** [July 2, 2024, 8:12pm UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/30 "2024-07-02T20:12:31Z")
At first IA had to cater to dumb controls engineers, and now their product is so good they have to cater to dumb everyone ---
**Author:** ![Robert\_Boekhout](https://avatars.discourse-cdn.com/v4/letter/r/58956e/32.png) [@Robert\_Boekhout](https://forum.inductiveautomation.com/u/Robert_Boekhout)\ **Post date:** [August 17, 2024, 6:28am UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/31 "2024-08-17T06:28:39Z")
Hmm. I dunno. I feel like you could have rolled this out without users having to make modifications to configuration files or requiring internet access. You could make it a non-persistent setting that's client based, rather than client launcher based, tied to the gateway the user is connecting to, configurable in said gateway. Launcher queries gateway strength setting and applies setting to client session. Strength setting in the gateway is required and defaults to LENIENT. Each new client session requires a check (as it already does). Now, no matter what versions end users have of the launcher, it doesn't matter. The client launcher will honor the Gateway's signature strength requirement. I might be missing something here, but I don't see how this not only isn't possible, but difficult to implement. Maybe doug is getting a little slack here, but they're right. Ya'll rolled out a feature that now requires internet access (or modifications to config files) to function as intended, when there were other possible (and better) solutions. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 17, 2024, 11:44am UTC](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670/32 "2024-08-17T11:44:08Z")
Same answer as I supplied over here: > [@How to turn off certification revocation check in Ignition 8.1.37?](https://forum.inductiveautomation.com/t/how-to-turn-off-certification-revocation-check-in-ignition-8-1-37/86440/14): > > So, you want the target that the launcher is trying to verify to supply the verification criteria? Like a fox in the henhouse? To be secure in today's environments, certificates are supposed to be verified. Any setting to reduce that security has to be deliberate, and not involve the target to be verified. [Previous page](https://forum.inductiveautomation.com/t/designer-startup-verifying-signature-of-designer/82670.md?page=1)