This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi, I get this error in the last few weeks and I am not sure, whether I should do something about it. I went to TechNet, Event ID 11 Automatic Root Certificates Update Configuration, but I would need something simpler that I can follow. Confuseduser P.S. Exact error message is below: -
Log Name: Application
Source: Microsoft-Windows-CAPI2
Date: 27/05/2009 8:42:16 PM
Event ID: 11
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Helga-PC
Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />
<EventID Qualifiers="49154">11</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-05-27T10:42:16.000Z" />
<EventRecordID>32381</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Helga-PC</Computer>
<Security />
</System>
<EventData>
<Data>http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</Data>
<Data>A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
</Data>
</EventData>
</Event>
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
I don't see any reason the solution above would not work in Vista. I see the same folder structure and registry entries on Vista.
If you are not familiar with the registry, here is a very detailed instruction set on how to delete entries: http://support.microsoft.com/kb/136393
Be sure to use the export option before deleting entries in order to back them up.
This does help.
Now that you've pointed this out I've seen the same behaviour in the CAPI2 Event Viewer log file. My Windows 7 clients have been trying to access two URL's at the domain http://crl.microsoft.com/
None of the posts I had seen on this had mentioned the need for this path.
Thanks,
Michael
hi
Here's a basic definition for CRL in general terms. You can search Google using "Certificate Revocation List" and find a lot more information.
it could also be that direct X is looking for some updated drivers
what happens is that your browser is checking for provoked certificates , is perfectly normal and safe , its to keep you safe
have a nice day
ps for some further info
http://technet.microsoft.com/en-us/library/dd772269.aspx
Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs+ Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
Hi Kem, I think the disabling of the WMP Network Sharing Service has done the trick for me as well. Thanks so much. Confuseduser
Looks promising, SSS. However, I'd prefer the solution to come as a patch included in a coming Update. What do you think?
For the time being my disabling of WMP Network Sharing Service already has the desired effect (but perhaps not for others).
We were seeing CAPI2 Event 11 on all our Windows 2008 servers and Windows Vista SP2 clients. We ran a trace on our ISA 2006 proxy server and it appears that the Crypto service was trying to connect anonymously to www.microsoft.com and was trying to download the following cert
http://www.microsoft.com/pki/certs/MicCerTruLisPCA\_2009-04-02.crt
The above link was blocked by our ISA proxy server even though we had a rule to allow internal clients to go outside to "Microsoft Update Domain Name Set" already included in ISA 2006. The above URL is not included in "Microsoft Update Domain Set". The solution is to add www.microsoft.com or *.microsoft.com to "Microsoft Update Domain Name Set in ISA" This cert is required to successfuly extract the list of Public Certificate Authorities.
Once this cert is downloaded, the Crypto service will download authrootstl.cab from http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
and extract autroot.stl in the client certificate store. Once this is done, CAPI errors will go away.
Below is the trace from ISA server where the Crypto service is denied access to this URL to download the cert. The crypto service tries to make an anonymous connection and is not authorized.
Microsoft-CryptoAPI/6.0 Yes Proxy XXXXXX www.microsoft.com TCP - - - Req ID: 0a887c69; Compression: client=No, server=No, compress rate=0% decompress rate=0% - - - 12/23/2009 10:20:32 PM 0 1 4314 2296 12202 The ISA Server denied the specified Uniform Resource Locator (URL). 0x0 0x80 Web Proxy Filter 12/23/2009 5:20:32 PM 10.10.1.20 80 http Denied Connection Default rule 10.10.8.100 Domain\TestClient Internal External GET http://www.microsoft.com/pki/certs/MicCerTruLisPCA\_2009-04-02.crt
I hope this helps.
