Windows 7 Ultimate getting tons of CAPI2- 4107 errors in application event log.

Anonymous

Log Name: Application

Source: Microsoft-Windows-CAPI2

Date: 7/11/2010 11:57:04 AM

Event ID: 4107

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer:

Description:

Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Event Xml:

<Channel>Application</Channel>

<Computer>Kronos</Computer>

</System>

<Data>http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</Data>

<Data>A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

</Data>

</EventData>

</Event>

I started getting this error on July 11th at 11:57am CST. I was doing nothing at the time other than browsing. My computer is properly time syncing. It appears that Microsoft is issuing a certificate with bad info, since downloading the cert myself and viewing it says that the certificate is not valid for the requested usage. There are literally over a thousand of these errors now piled up but there seems to be no end in sight. I tripped across them doing a weekly check of the logs. I am experiencing no performance degradation or BSODs. I ran "sfc /scannow" as admin and it found no problems.

The certificate is issued by Microsoft and signed by Microsoft, off of Microsoft servers.

Other places mention that the windows media player media server can cause this but their only fix is to disable the service. Not kosher.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hi everyone,

For the people receiving the CAPI2 ID 11 “Failed extract of third-party rootlist…” generated in the application log:

· Click the Pearl (Start) Orb on the Desktop

· In the Search box typeCMD (do not hit enter)

· Right-Click cmd.exe and selectRun as administrator

Once the Command Prompt window is open type the following command and press enter.

certutil -urlcache * delete

*Note* There is a space between * & delete

Once it has completed it should show the following:

CertUtil: -URLCache command completed successfully

If the expired certificate is cached in the system profile, then you will need to run it in the system context.

To do this, download PsExec

Select Open then Double click PsExec.exe

Select Extract and choose the location, (Take note of this location) make a new folder called PsTools and select Extract

Now Open the Command Prompt as the administrator and browse to the location of the PsTools folder.

So if you extracted to your Desktop the Command Prompt should look like this:

C:\Users<username>\Desktop\PsTools

Type the following and hit enter:

psexec -i -s cmd.exe

A new Command Prompt window should open, from here type the following command again and hit enter:

certutil -urlcache * delete

If these steps do not work use the steps below to enable CAPI2 logging, please copy and paste the details of the error log in this thread.

Click 'Start' > Type Event in the search bar and select 'Event Viewer'

Expand 'Applications and Services Logs'

Expand 'Microsoft'

Expand 'Windows'

Expand 'CAPI2'

Select 'Operational'

On the far right pane > Click 'Enable Log'

Cody C

Microsoft Answers Support Engineer

Visit our Microsoft Answers Feedback Forum and let us know what you think.

0 comments

Answer accepted by question author

Anonymous

FYI, compliments of SBS MVP Susan Bradley...

CAPI2 errors driving you crazy? - THE OFFICIAL BLOG OF THE SBS "DIVA"

http://msmvps.com/blogs/bradley/archive/2010/09/02/capi2-errors-driving-you-crazy.aspx

~Robear Dyer (PA Bear) ~ MS MVP (IE, Mail, Security, Windows & Update Services) since 2002 ~ Disclaimer: MS MVPs neither represent nor work for Microsoft

0 comments

52 additional answers

Anonymous

2010-10-15T18:01:34+00:00

Hi Cody,

I am getting the error you refer to and have followed the steps you outline in your post. I am running Windows 7

The System was restarted on 15/10/2010 at 8:01:04am (15th October European date)

The details behind "Error 15/10/2010 8:09:33 AMCAPI2 11Build Chain" (see the list of Events at the bottom of this post) are:

Log Name: Microsoft-Windows-CAPI2/Operational

Source: Microsoft-Windows-CAPI2

Date: 15/10/2010 8:09:33 AM

Event ID: 11

Task Category: Build Chain

Level: Error

Keywords: Path Validation,Path Validation

User: LifeIsADream\Neil

Computer: LifeIsADream

Description:

For more details for this event, please refer to the "Details" section

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

   <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" />

   <EventID>11</EventID>

   <Version>0</Version>

   <Level>2</Level>

   <Task>11</Task>

   <Opcode>2</Opcode>

   <Keywords>0x4000000000000003</Keywords>

   <TimeCreated SystemTime="2010-10-15T06:09:33.429850100Z" />

   <EventRecordID>47537</EventRecordID>

   <Correlation />

   <Execution ProcessID="4568" ThreadID="4928" />

   <Channel>Microsoft-Windows-CAPI2/Operational</Channel>

   <Computer>LifeIsADream</Computer>

   <Security UserID="S-1-5-21-4179289484-126802350-119673838-1003" />

  </System>

  <UserData>

   <CertGetCertificateChain>

   <Certificate fileRef="D5B92F04907D63A035AE714343E73ADC0EACE20C.cer" subjectName="SupportSoft, Inc." />

   <ValidationTime>2010-10-15T06:09:33.300Z</ValidationTime>

   <AdditionalStore>

   <Certificate fileRef="D5B92F04907D63A035AE714343E73ADC0EACE20C.cer" subjectName="SupportSoft, Inc." />

   <Certificate fileRef="826B2D0FF5D618969F5F473E0F209A4794016450.cer" subjectName="VeriSign Class 3 Code Signing 2004 CA" />

   <Certificate fileRef="742C3192E607E424EB4549542BE1BBC53E6174E2.cer" subjectName="Class 3 Public Primary Certification Authority" />

   </AdditionalStore>

   <ExtendedKeyUsage>

   <Usage oid="1.3.6.1.5.5.7.3.3" name="Code Signing" />

   </ExtendedKeyUsage>

   <Flags value="48000001" CERT_CHAIN_CACHE_END_CERT="true" CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT="true" CERT_CHAIN_REVOCATION_ACCUMULATIVE_TIMEOUT="true" />

   <ChainEngineInfo context="user" />

   <AdditionalInfo>

   <NetworkConnectivityStatus value="1" _SENSAPI_NETWORK_ALIVE_LAN="true" />

   </AdditionalInfo>

   <CertificateChain chainRef="{CB3EA8E2-3028-4225-8732-E1F64405F652}" revocationFreshnessTime="P29DT6H9M33S">

   <TrustStatus>

   <ErrorStatus value="1" CERT_TRUST_IS_NOT_TIME_VALID="true" />

   <InfoStatus value="100" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />

   </TrustStatus>

   <ChainElement>

   <Certificate fileRef="D5B92F04907D63A035AE714343E73ADC0EACE20C.cer" subjectName="SupportSoft, Inc." />

   <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />

   <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="2048" />

   <TrustStatus>

   <ErrorStatus value="1" CERT_TRUST_IS_NOT_TIME_VALID="true" />

   <InfoStatus value="102" CERT_TRUST_HAS_KEY_MATCH_ISSUER="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />

   </TrustStatus>

   <ApplicationUsage>

   <Usage oid="1.3.6.1.5.5.7.3.3" name="Code Signing" />

   </ApplicationUsage>

   <IssuanceUsage>

   <Usage oid="2.16.840.1.113733.1.7.23.3" />

   </IssuanceUsage>

   <RevocationInfo freshnessTime="P4DT21H28M14S">

   <RevocationResult value="0" />

   <OCSPResponse location="UrlCache" url="http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCEDMT2aSTAlfjSHzwlZ32O0c%3D" fileRef="0FD9CCFB9C3CDF639AC4D0D5F26001DB7C5584F2.bin" issuerName="VeriSign Class 3 Code Signing 2004 CA" />

   </RevocationInfo>

   </ChainElement>

   <ChainElement>

   <Certificate fileRef="826B2D0FF5D618969F5F473E0F209A4794016450.cer" subjectName="VeriSign Class 3 Code Signing 2004 CA" />

   <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />

   <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="2048" />

   <TrustStatus>

   <ErrorStatus value="1" CERT_TRUST_IS_NOT_TIME_VALID="true" />

   <InfoStatus value="101" CERT_TRUST_HAS_EXACT_MATCH_ISSUER="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />

   </TrustStatus>

   <ApplicationUsage>

   <Usage oid="1.3.6.1.5.5.7.3.2" name="Client Authentication" />

   <Usage oid="1.3.6.1.5.5.7.3.3" name="Code Signing" />

   </ApplicationUsage>

   <IssuanceUsage>

   <Usage oid="2.16.840.1.113733.1.7.23.3" />

   </IssuanceUsage>

   <RevocationInfo freshnessTime="P29DT6H9M33S">

   <RevocationResult value="0" />

   <CertificateRevocationList location="TvoCache" url="http://crl.verisign.com/pca3.crl" fileRef="9B415675855302C61FF821063533CD35D3827A1A.crl" issuerName="Class 3 Public Primary Certification Authority" />

   </RevocationInfo>

   </ChainElement>

   <ChainElement>

   <Certificate fileRef="742C3192E607E424EB4549542BE1BBC53E6174E2.cer" subjectName="Class 3 Public Primary Certification Authority" />

   <SignatureAlgorithm oid="1.2.840.113549.1.1.2" hashName="MD2" publicKeyName="RSA" />

   <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="1024" />

   <TrustStatus>

   <ErrorStatus value="0" />

   <InfoStatus value="10C" CERT_TRUST_HAS_NAME_MATCH_ISSUER="true" CERT_TRUST_IS_SELF_SIGNED="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />

   </TrustStatus>

   <ApplicationUsage>

   <Usage oid="1.3.6.1.5.5.7.3.4" name="Secure Email" />

   <Usage oid="1.3.6.1.5.5.7.3.2" name="Client Authentication" />

   <Usage oid="1.3.6.1.5.5.7.3.3" name="Code Signing" />

   <Usage oid="1.3.6.1.5.5.7.3.1" name="Server Authentication" />

   </ApplicationUsage>

   <IssuanceUsage any="true" />

   </ChainElement>

   </CertificateChain>

   <EventAuxInfo ProcessName="sprtcmd.exe" />

   <CorrelationAuxInfo TaskId="{DFB5C00B-E8C3-4476-ADA2-D1A681E9A680}" SeqNumber="21" />

   <Result value="800B0101">A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.</Result>

   </CertGetCertificateChain>

  </UserData>

</Event>

This seems to be the relevant section of my error log:

Information 15/10/2010 8:09:42 AMCAPI2 10Build Chain

Information 15/10/2010 8:09:42 AMCAPI2 80Verify Trust

Error 15/10/2010 8:09:37 AMCAPI2 82Find Security Catalog for File

Information 15/10/2010 8:09:37 AMCAPI2 82Find Security Catalog for File

Error 15/10/2010 8:09:37 AMCAPI2 82Find Security Catalog for File

Information 15/10/2010 8:09:37 AMCAPI2 82Find Security Catalog for File

Error 15/10/2010 8:09:37 AMCAPI2 82Find Security Catalog for File

Information 15/10/2010 8:09:37 AMCAPI2 82Find Security Catalog for File

Error 15/10/2010 8:09:37 AMCAPI2 82Find Security Catalog for File

Information 15/10/2010 8:09:37 AMCAPI2 82Find Security Catalog for File

Error 15/10/2010 8:09:33 AMCAPI2 81Verify Trust

Information 15/10/2010 8:09:33 AMCAPI2 90X509 Objects

Error 15/10/2010 8:09:33 AMCAPI2 30Verify Chain Policy

Error 15/10/2010 8:09:33 AMCAPI2 11Build Chain

Information 15/10/2010 8:09:33 AMCAPI2 41Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 40Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 41Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 40Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 41Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 40Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 10Build Chain

Information 15/10/2010 8:09:33 AMCAPI2 80Verify Trust

Error 15/10/2010 8:09:33 AMCAPI2 81Verify Trust

Information 15/10/2010 8:09:33 AMCAPI2 90X509 Objects

Error 15/10/2010 8:09:33 AMCAPI2 30Verify Chain Policy

Error 15/10/2010 8:09:33 AMCAPI2 11Build Chain

Information 15/10/2010 8:09:33 AMCAPI2 41Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 40Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 41Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 40Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 41Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 40Verify Revocation

Information 15/10/2010 8:09:33 AMCAPI2 10Build Chain

Information 15/10/2010 8:09:33 AMCAPI2 80Verify Trust

Error 15/10/2010 8:09:33 AMCAPI2 81Verify Trust

Information 15/10/2010 8:09:33 AMCAPI2 90X509 Objects

Error 15/10/2010 8:09:33 AMCAPI2 30Verify Chain Policy

Error 15/10/2010 8:09:33 AMCAPI2 11Build Chain

Information 15/10/2010 8:09:33 AMCAPI2 30Verify Chain Policy

Information 15/10/2010 8:09:33 AMCAPI2 30Verify Chain Policy

Information 15/10/2010 8:09:33 AMCAPI2 11Build Chain

Information 15/10/2010 8:09:33 AMCAPI2 10Build Chain

Information 15/10/2010 8:09:33 AMCAPI2 18Retrieve Third-Party Root Certificate from Cache

Information 15/10/2010 8:09:33 AMCAPI2 51Retrieve Object from Cache

Information 15/10/2010 8:09:33 AMCAPI2 50Retrieve Object from Cache

Information 15/10/2010 8:09:33 AMCAPI2 17Retrieve Third-Party Root Certificate from Cache

I look forward to your advice as I need to get this error fixed before I can run some navigation software.

Many thanks

Neil
Was this answer helpful?

0 comments No comments
Anonymous

2010-10-03T14:44:10+00:00

See...

Event ID 4107 or 11 is logged in the Application Log in Windows Vista or Windows Server 2008 and later (26 August 2010)

http://support.microsoft.com/kb/2328240

~Robear Dyer (PA Bear) ~ MS MVP (IE, Mail, Security, Windows & Update Services) since 2002 ~ Disclaimer: MS MVPs neither represent nor work for Microsoft

Unfortunately this simply does not work. The KB article has been updated at least once, and I tried its instructions when this was first posted, and again last week with the updated instructions. And I still get the same CAPI2 4017 error several times a day.

It really shouldn't be marked as an answer, since it doesn't actually solve the problem
Was this answer helpful?

0 comments No comments
Anonymous

2010-09-30T10:23:21+00:00

Can anyone help me I have CAPI2 consentexe. error 11 on both new pc and I have tried several different fixes no luck. I started getting this error after a windows update was installed. I have permissions issues due to this error any heolp would be great!Log Name:      Microsoft-Windows-CAPI2/Operational

Source:        Microsoft-Windows-CAPI2

Date:          9/18/2010 7:46:54 PM

Event ID:      11

Task Category: Build Chain

Level:         Error

Keywords:      Path Discovery,Path Validation

User:          SavannahMick-PC\SavannahMick

Computer:      SavannahMick-PC

Description:

For more details for this event, please refer to the "Details" section

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

    <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" />

    <EventID>11</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>11</Task>

    <Opcode>2</Opcode>

    <Keywords>0x4000000000000003</Keywords>

    <TimeCreated SystemTime="2010-09-18T23:46:54.486731300Z" />

    <EventRecordID>23524</EventRecordID>

    <Correlation />

    <Execution ProcessID="2580" ThreadID="2736" />

    <Channel>Microsoft-Windows-CAPI2/Operational</Channel>

    <Computer>SavannahMick-PC</Computer>

    <Security UserID="S-1-5-21-163695203-2985681545-29013369-1001" />

</System>

<UserData>

    <CertGetCertificateChain>

      <Certificate fileRef="80B9915817340CEE66D71EC27DA5F96EBF8D94D8.cer" subjectName="Microsoft Time-Stamp Service" />

      <ValidationTime>2009-07-14T02:50:48Z</ValidationTime>

      <AdditionalStore>

        <Certificate fileRef="5DF0D7571B0780783960C68B78571FFD7EDAF021.cer" subjectName="Microsoft Windows Verification PCA" />

        <Certificate fileRef="375FCB825C3DC3752A02E34EB70993B4997191EF.cer" subjectName="Microsoft Time-Stamp PCA" />

        <Certificate fileRef="018B222E21FBB2952304D04D1D87F736ED46DEA4.cer" subjectName="Microsoft Windows" />

        <Certificate fileRef="80B9915817340CEE66D71EC27DA5F96EBF8D94D8.cer" subjectName="Microsoft Time-Stamp Service" />

      </AdditionalStore>

      <ExtendedKeyUsage>

        <Usage oid="1.3.6.1.5.5.7.3.8" name="Time Stamping" />

      </ExtendedKeyUsage>

      <Flags value="C8000005" CERT_CHAIN_CACHE_END_CERT="true" CERT_CHAIN_CACHE_ONLY_URL_RETRIEVAL="true" CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT="true" CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY="true" CERT_CHAIN_REVOCATION_ACCUMULATIVE_TIMEOUT="true" />

      <ChainEngineInfo context="user" />

      <CertificateChain chainRef="{FFC151D2-27D1-41B7-AFEC-E4161BFFE6BB}">

        <TrustStatus>

          <ErrorStatus value="1000040" CERT_TRUST_REVOCATION_STATUS_UNKNOWN="true" CERT_TRUST_IS_OFFLINE_REVOCATION="true" />

          <InfoStatus value="100" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />

        </TrustStatus>

        <ChainElement>

          <Certificate fileRef="80B9915817340CEE66D71EC27DA5F96EBF8D94D8.cer" subjectName="Microsoft Time-Stamp Service" />

          <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />

          <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="2048" />

          <TrustStatus>

            <ErrorStatus value="1000040" CERT_TRUST_REVOCATION_STATUS_UNKNOWN="true" CERT_TRUST_IS_OFFLINE_REVOCATION="true" />

            <InfoStatus value="102" CERT_TRUST_HAS_KEY_MATCH_ISSUER="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />

          </TrustStatus>

          <ApplicationUsage>

            <Usage oid="1.3.6.1.5.5.7.3.8" name="Time Stamping" />

          </ApplicationUsage>

          <IssuanceUsage />

          <RevocationInfo>

            <RevocationResult value="80092013">The revocation function was unable to check revocation because the revocation server was offline.</RevocationResult>

          </RevocationInfo>

        </ChainElement>

        <ChainElement>

          <Certificate fileRef="375FCB825C3DC3752A02E34EB70993B4997191EF.cer" subjectName="Microsoft Time-Stamp PCA" />

          <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />

          <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="2048" />

          <TrustStatus>

            <ErrorStatus value="0" />

            <InfoStatus value="101" CERT_TRUST_HAS_EXACT_MATCH_ISSUER="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />

          </TrustStatus>

          <ApplicationUsage>

            <Usage oid="1.3.6.1.5.5.7.3.8" name="Time Stamping" />

          </ApplicationUsage>

          <IssuanceUsage />

          <RevocationInfo freshnessTime="P124DT0H19M11S">

            <RevocationResult value="0" />

            <CertificateRevocationList location="TvoCache" url="http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl" fileRef="6CC49C402F7C2A28CCF67F6DC1AFB9E5D79CDE10.crl" issuerName="Microsoft Root Certificate Authority" />

          </RevocationInfo>

        </ChainElement>

        <ChainElement>

          <Certificate fileRef="CDD4EEAE6000AC7F40C3802C171E30148030C072.cer" subjectName="Microsoft Root Certificate Authority" />

          <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />

          <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="4096" />

          <TrustStatus>

            <ErrorStatus value="0" />

            <InfoStatus value="10C" CERT_TRUST_HAS_NAME_MATCH_ISSUER="true" CERT_TRUST_IS_SELF_SIGNED="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />

          </TrustStatus>

          <ApplicationUsage any="true" />

          <IssuanceUsage any="true" />

        </ChainElement>

      </CertificateChain>

      <EventAuxInfo ProcessName="consent.exe" impersonateToken="S-1-5-21-163695203-2985681545-29013369-1001" />

      <CorrelationAuxInfo TaskId="{D669B361-1D62-4626-B056-7DA554F6D12F}" SeqNumber="13" />

      <Result value="80092013">The revocation function was unable to check revocation because the revocation server was offline.</Result>

    </CertGetCertificateChain>

</UserData>

</Event>
Was this answer helpful?

0 comments No comments