windows service causes root certificate update on system with no internet access

Question

So I have a C# windows service that on some systems where there is no internet access won't start. It tries to start, but times out before the service is started. I'm unable to reproduce the issue in any development environment, but have seen it several times on other systems(usually w2k3).

When I put my service into a debug mode the first thing that I do is create a log file on the local pc, but this file is never being created so I believe that the OnStart code is never even being called.

On one of the systems we saw an Event Log entry which led us to this KB article: http://support.microsoft.com/kb/317541

So, by following the article by stopping the root certificate update service or connecting the device to the internet our service would now start. The other interesting thing is we have 3 services all start with almost identical code yet it's always a particular one of the 3 that fails to start. Here is our code from the OnStart method:

if (args.Length > 0)
        {
            if (args[0].ToLower().Equals("debug"))
            {
                string AppLog = System.Reflection.Assembly.GetExecutingAssembly().GetName().Name;

                string locallogpath = Settings.Settings.ServiceLogFileLocation.ToString();
                if (!Directory.Exists(locallogpath))
                {
                    Directory.CreateDirectory(locallogpath);
                }
                LogFileName = Path.Combine(locallogpath, AppLog + ".htm");
                try
                {
                    _logFile = new StreamWriter(new FileStream(LogFileName, System.IO.FileMode.Create));

                    _logFile.WriteLine(htmlHeader + "<span class=lognormal>Service Started!</span><br>");
                    _logFile.Close();
                }
                catch { }

                IsDebug = true;
            }
        }

My question is what could we possibly be doing that would cause the root certificate update to occur hence failing when no internet connection is available?

Answer 1

Are there any certificate signed assemblies involved in running this service? Those could trigger a sequence of events in verifying signatures which could very well result in Windows needing to check the status of root certificates.

My guess is, if you need to run the affected service on a non-connected server, your only choice is to keep the root certificate update service stopped.

I'd guess your logging code has nothing to do with it.