Microsoft-Windows CAPI2 failed extract of third-party root list from auto update cab

Anonymous

Hi, I get this error in the last few weeks and I am not sure, whether I should do something about it. I went to TechNet, Event ID 11 Automatic Root Certificates Update Configuration, but I would need something simpler that I can follow. Confuseduser P.S. Exact error message is below: -

Log Name: Application

Source: Microsoft-Windows-CAPI2

Date: 27/05/2009 8:42:16 PM

Event ID: 11

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: Helga-PC

Description:

Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Event Xml:

<Channel>Application</Channel>

<Computer>Helga-PC</Computer>

</System>

<Data>http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</Data>

<Data>A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

</Data>

</EventData>

</Event>

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

I don't see any reason the solution above would not work in Vista. I see the same folder structure and registry entries on Vista.

If you are not familiar with the registry, here is a very detailed instruction set on how to delete entries: http://support.microsoft.com/kb/136393

Be sure to use the export option before deleting entries in order to back them up.

0 comments

Answer accepted by question author

Anonymous

This does help.

Now that you've pointed this out I've seen the same behaviour in the CAPI2 Event Viewer log file. My Windows 7 clients have been trying to access two URL's at the domain http://crl.microsoft.com/

None of the posts I had seen on this had mentioned the need for this path.

Thanks,

Michael

Here's a basic definition for CRL in general terms. You can search Google using "Certificate Revocation List" and find a lot more information.

it could also be that direct X is looking for some updated drivers

what happens is that your browser is checking for provoked certificates , is perfectly normal and safe , its to keep you safe

have a nice day

ps for some further info

http://technet.microsoft.com/en-us/library/dd772269.aspx

Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs+ Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!

0 comments

138 additional answers

Anonymous

2009-11-08T20:51:04+00:00

I too concur with the last post. The above fix does not work on SBS2008 and the server stops at "Applying computer settings". I had to restore the settings in Safe Mode in order for the servers to start up normally.

Pete
Was this answer helpful?

0 comments No comments
Anonymous

2009-11-08T12:55:35+00:00

NOTE: The solution above is not working on a domain controller. After trying this the machine would not boot up again. It stops at "Applying computer settings" forever! Still having these issues on my SBS 2008 computer
Was this answer helpful?

0 comments No comments
Anonymous

2009-10-28T20:57:37+00:00

From another forum:

Based on my research, the issue can be caused by corrupted certificate data on the server. I suggest you try the following steps to test the issue:

1. Backup and delete the contents of the following folders:

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\ContentC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData

2. Backup and delete the certificates listed under "Certificates" key:

HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates

Then, restart the server to check the result.

I did this on one of the servers on which I have an error.

Let me stress this... DO THE BACKUPs IT MENTIONS AS MESSING WITH THE REGISTRY CAN HAVE VERY SERIOUS SIDE EFFECTS.

I have been struggling with this issue for about 3 months on 4 2008 servers, some physical and some VMs.

I deleted the folders as suggested by Kevin Zhao above. After a reboot, I now get CAPI2 eventID 13 Informational messages stating: Successful auto property update of third-party root certificate...etc.

I'm going to continue to monitor the server on which I attempted this remedy. If it holds, I think we have a winner.

I can confirm that this indeed works (at least in my scenario). I've stumbled on the problem on 32-bit Vista SP2. According to CAPI2 log in the Event Log infocard.exe was responsible for the failed attempt to update the certificates. Every time I would start the Windows Cardspace service the error would be logged. The issue didn't occur on a fresh install of Windows Vista (SP2, root certificates updated to May 2009) on a virtual machine. I figure that even though viewing the STL file from the CAB does show that "it's not valid" - it's not the issue. After reboot the root certificates where automatically updated without any problem (just in case I've downloaded the root certificates from May 2009 as mentioned in this thread earlier)

I've tried the above solution. And it worked (at least so far).

Thank you very much for posting this.
Was this answer helpful?

0 comments No comments