Microsoft-Windows CAPI2 failed extract of third-party root list from auto update cab

What is this thing?!? And, has anyone found a way of getting rid of it? I have followed about 5 steps listed on this forum by "technicians" and I still keep getting this error. I have noticed others have logged events and were able to determine the cause, but no errors appear in the logging for me -- only in the event viewer.

From what I know about it CAPI2 is the Crypto API of Windows. It looks like the CTL (Certificate Trust List) Microsoft currently offers on their update sites is broken (invalid signature). So Windows does not accept it for security reason. If Windows would accept it, then anybody could forge a fake certificate trust list and inject it which would open an attack vector for intruders.

Most probably the error is simply triggered by any application using SSL connections with the help of the crypto API (CAPI2). So the first application using the API might trigger the (still pending since id did not succeed) CTL update which fails each time because the CTL provided by Microsoft is invalid.

On some machines the error does not occur. This might be related to the fact that some people switch off WU or did not apply some patches. I noticed that the certificate revocation list update is an optional update on Windows Update which I usually apply to all machines. Maybe this triggers the problem. Installation of SP2 might trigger it too because it might contain a related update.

In some cases enabling CAPI2 logging helps to find the process which actually triggers the CTL update. This might allow you to disable it. In my case it was the "Windows Media Player Network Sharing Service" which is a Microsoft built-in service. Disabling (or setting startup type to "manual") made the CAPI2 error to disappear on my machine.

What irritates me is the fact that it seems the CAPI2 error completely disappeared from my system logs. So my statement above might not be true in any case (first application using crypto API triggers the error). Maybe the error is triggered only if CAPI2 is invoked too early at the boot stage (when starting services). Unfortunately you might not be able to fix it if an antivirus program (which needs to run as a service on system boot) triggers the error too early.

I think we made a lot of good conclusions and findings in this thread. It's now about Microsoft to fix the issue.

I just recently noticed this error in my Event Viewer as well:

Log Name:      Application

Source:        Microsoft-Windows-CAPI2

Date:          8/8/2009 1:56:04 PM

Event ID:      11

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      user-PC

Description:

Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />

    <EventID Qualifiers="49154">11</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2009-08-08T17:56:04.000Z" />

    <EventRecordID>15024</EventRecordID>

    <Correlation />

    <Execution ProcessID="0" ThreadID="0" />

    <Channel>Application</Channel>

    <Computer>user-PC</Computer>

    <Security />

  </System>

  <EventData>

    <Data>http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</Data>

    <Data>A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

</Data>

  </EventData>

</Event>

I noticed that my first incidence of this CAPI2 error began on June 23, 2009 of this year after upgrading to Windows Service Pack 2 on my Windows Vista 32-bit OS. I have tried typing "Certutil -urlcache * delete" in cmd and running sf /scannow and the error still occurs. If I click on the link given in the Even Viewer (http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab) it simply asks me if I wish to open, save or cancel the the 27.9KB authrootstl.cab download. I have gone to Applications and Services\Logs\Microsoft\Windows\CAPI2\Operational and enabled logging. However, none of the errors in the Event Viewer come up during logging. What is this thing?!? And, has anyone found a way of getting rid of it? I have followed about 5 steps listed on this forum by "technicians" and I still keep getting this error. I have noticed others have logged events and were able to determine the cause, but no errors appear in the logging for me -- only in the event viewer.

Hi again, apparently the link below is a link to Microsoft.  Maybe somebody (who can cope with all the technical details) could send them the information. Confuseduser
https://connect.microsoft.com/default.aspx

What's Connect?

This site is a connection point between you and Microsoft, and ultimately the larger community. Your feedback enables Microsoft to make software and services the best that they can be, and you can learn about and contribute to exciting projects