Slow UAC – Fixing SSL Connection Issues to Router

connectiondnsperformanceuac

Some apps (UAC and others) have been slow to open, a 5~25 second delay. Even task manager, because of UAC. This is consistent.

Resource Manager showed 100+ new connections being created to my router's hostname edgerouter.fnc within seconds, and closed immediately.

consent.exe lots of connections to router

wireshark showing packets of one connection

Eventually I discovered that my router's hostname, not IP address, was shown in these connections. I removed hostname from my hosts file and from my DNS server (Acrylic). That is a workaround, no more connections are being created. I can also disable the web server in my router, this also prevents connections being created.

But this isn't a real solution. I should be able to give my router a hostname in my DNS server.

So why are these connections created? You can't say it's consent.exe, because other apps do it too, and it's not normal behavior. It's not malware, I've scanned with two separate applications.

I can't test it in Safe Mode, since UAC doesn't show up.

Edit: if I change the name in my hosts file, say 192.168.1.1 blabla, no connections are made and there is no delay.

Edit: for some applications, consent.exe is fast. For some, it takes 25 seconds.

Edit: TCPView was not helpful. At least Wireshark shows all traffic, which isn't helpful because of SSL (can't see a thing).

Edit: The name edgerouter.fnc also doesn't occur in my registry. I did have a self signed certificate with that name, so Chrome would accept it. That certificate is now gone, and I didn't delete it myself.

Edit: The issue disappeared! The router now has a new certificate, probably through a software update. I downloaded that certificate, installed it, added the new name to my hosts file. Using the hostname, I can connect to the router, browser is happy. Consent.exe is no longer creating SSL connections to the router.

Best Answer

Not a guaranteed solution, but it most likely has to do with custom or self signed certificates.

Run

certmgr.msc

and look under Trusted Root Certification Authorities to find anything self-signed, i. e. not issued by an existing certification authority.

All I did is delete that certificate and the problem was gone.

Explanation:

I created a certificate for my router, that I installed as a trusted root certificate. Because otherwise, my browser kept showing nasty certificate errors.

Wireshark proved that the hostname was specifically requested by my computer. So that points to the hostname being read from somewhere, not the registry - because I checked for that. The only other place was my certificate store.

Addendum: It looks like consent.exe checks if certificates have been revoked. The poster of this answer had self signed certificates and problems with them as well: https://security.stackexchange.com/a/179064

Related Question