This issue occurs because the Exchange server issues network requests to connect to http://crl.microsoft.com/pki/crl/products/CodeSigPCA.crl and look up the certificate revocation list at NGEN time for each assembly that it compiles to native code.
Because the Exchange server is not connected to the Internet, each request must wait to timeout before moving on.
Prevention Step: Turn off the Check for publisher’s certificate revocation option on the server that is being upgraded. Follow these steps:
In Windows Internet Explorer –> Tools –> Internet Options –> Advanced tab In the Security section, uncheck or clear the box for below tow options
“Check for publisher’s certificate revocation” “Check for server certificate revocation”
It is considered safe to clear this security option in Internet Explorer if the computer is in a tightly controlled environment. After the setup has completed, turn on the Check for publisher’s certificate revocation option again