SharePoint site can't load

Question

We have a SharePoint 2013 farm deployed according to 3-tiers architecture :

• 2 application servers;
• 2 web servers;
• 2 data base servers.

on this farm we have a web application that don't load. trying to resolve this problem, we examin web servers logs and we found this events :

sharepoint foundation error (event 8321) :

"A certificate validation operation took 30017,2629 milliseconds and has exceeded the execution time threshold. If this continues to occur, it may represent a configuration issue. Please see http://go.microsoft.com/fwlink/?LinkId=246987 for more details"

IIS error (we have iis8) :

"A process serving application pool 'web application pool' suffered a fatal communication error with the Windows Process Activation Service. The process id was 'processId'. The data field contains the error number"

we couldn't find the process mentionned in the error msg with the processes running.

we found also a system error related to kerberos with eventid = 4 :

"The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server machineName. The target name used was HTTP/nomMachine. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (domaineName) is different from the client domain (domaineName), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server."

I wonder if these problems are related ? what is the source of the problem ? and how can I resolve it ?

Answer 1

That's because SharePoint is trying to check certificates. This is a kind on known issue. You need to add certificate.

https://support.microsoft.com/en-us/help/2625048/site-slowness-because-of-sharepoint-sts-certificate-crl-checking

In short

1. Obtain the "SharePoint Root Authority" certificate as a physical (.cer) file This step involves getting the SharePoint Root Authority Certificate as a

   • Launch the SharePoint 2010 PowerShell window as Administrator

   • $rootCert = (Get-SPCertificateAuthority).RootCertificate

   • $rootCert.Export("Cert") | Set-Content C:\SharePointRootAuthority.cer -Encoding byte

Note: The .cer file exported in this step can be used on other servers in the farm without having to run the Powershell commands again.

2. Import the "SharePoint Root Authority" certificate to the Trusted Root Certification store Now that we have the certificate file exported from SharePoint, we can add it to the server's Trusted Root Certification Authorities list of certificates.

   • Start > Run > MMC > Enter

   • File > Add/Remove Snap-in

   • Certificates > Add > Computer account > Next > Local computer > Finish > OK

   • Expand Certificates (Local Computer), expand Trusted Root Certification Authorities

   • Right-click Certificates > All tasks > Import

   • Next > Browse > navigate to and select C:\SharePointRootAuthority.cer > Open > Next > Next > Finish > OK

Answer 2

Try one of these if sites still don't work and SharePoint farm is configured correctly.

1. Access the SharePoint page and check the IIS error logs. This sometimes give better clue.
2. Check event viewer, it should record the error.
3. Ping the SharePoint domain and make sure it gives a valid IP address.
4. Make sure there is no firewall in between the app, web and db servers. If yes, make sure the ports are open so they can communicate.
5. Open the site in Chrome and inspect Network traffic for any 404/500 errors.
6. Check disk spaces on servers and an antivirus that can block file updates.