Microsoft-Windows CAPI2 failed extract of third-party root list from auto update cab

Anonymous

Hi, I get this error in the last few weeks and I am not sure, whether I should do something about it. I went to TechNet, Event ID 11 Automatic Root Certificates Update Configuration, but I would need something simpler that I can follow. Confuseduser P.S. Exact error message is below: -

Log Name: Application

Source: Microsoft-Windows-CAPI2

Date: 27/05/2009 8:42:16 PM

Event ID: 11

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: Helga-PC

Description:

Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Event Xml:

<Channel>Application</Channel>

<Computer>Helga-PC</Computer>

</System>

<Data>http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</Data>

<Data>A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

</Data>

</EventData>

</Event>

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

I don't see any reason the solution above would not work in Vista. I see the same folder structure and registry entries on Vista.

If you are not familiar with the registry, here is a very detailed instruction set on how to delete entries: http://support.microsoft.com/kb/136393

Be sure to use the export option before deleting entries in order to back them up.

0 comments

Answer accepted by question author

Anonymous

This does help.

Now that you've pointed this out I've seen the same behaviour in the CAPI2 Event Viewer log file. My Windows 7 clients have been trying to access two URL's at the domain http://crl.microsoft.com/

None of the posts I had seen on this had mentioned the need for this path.

Thanks,

Michael

Here's a basic definition for CRL in general terms. You can search Google using "Certificate Revocation List" and find a lot more information.

it could also be that direct X is looking for some updated drivers

what happens is that your browser is checking for provoked certificates , is perfectly normal and safe , its to keep you safe

have a nice day

ps for some further info

http://technet.microsoft.com/en-us/library/dd772269.aspx

Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs+ Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!

0 comments

138 additional answers

Anonymous

2009-06-24T15:58:57+00:00

Hi all, I am having the same CAPI2 error which started since 27 May 2009.

I am from Singapore and currently using Vista Ultimate SP1. Of course my Windows is activated.

This error in Event Log has been ongoing in my PC too.
Was this answer helpful?

0 comments No comments
Anonymous

2009-06-30T17:19:51+00:00

Cross-post from technet.... just trying to get some answers

I have been monitoring this thread and the similar thread here: http://social.technet.microsoft.com/Forums/en-US/itprovistasecurity/thread/fdf97ac2-21b7-49af-9fc5-d8b2dc3e8d83?prof=required

I can confirm this has been happening on a brand new install of Server 2008 Standard since June 16th. The install was from original media, then upgraded to SP1. The server is fully patched except for optional updates. It has the Web Server (IIS) role installed, with the .Net 3.0 Features, Remote Server administration Tools feature, and the Windows Porcess Activation Service features.

Since this thread hasn't had any activity, I was just wondering if anyone had found a solution. I agree that it definitely looks like the trust list itself is not valid.

As this is a planned web server that will host SSL sites, I am at a stand-still until this is resolved. I'm not going to put websites on it since I have no idea if the certs will report as valid to clients. I'd love to know which root certs would have an issue, if any.

I did run sfc /scannow at an elevated command line to verify the system protected file. It reported 100% valid.

Just for the heck of it, I reinstalled my MAK license key to make sure there is no licensing typo or something.

The CAPI2 error shows at least 8 times a day, every day. Sometimes more.
Was this answer helpful?

0 comments No comments
Anonymous

2009-07-14T17:55:34+00:00

Hello,

It sounds like there might be some corrupt or bad information in the cache, we can try the steps below to see if it resolves the errors in the Event Logs:

·         Click Start

·         In the ‘Search’ field type ‘cmd’

·         When cmd.exe is located, right click and select ‘Run as Administrator’

o   Note – you may get prompted for User Account Control Credentials if it’s enabled

·         Type the following command: Certutil –urlcache * delete

o   This command will clear the cache that is stored for certs and such

o   When this command is run you will probably see lots of scrolling text

o   When this is complete we should see a message that states it was completed successfully

Give this a try and let us know if it resolves the errors you are seeing.

Thanks

Michael

Microsoft Answers Support Engineer

Visit our Microsoft Answers Feedback Forum and let us know what you think.
Was this answer helpful?

0 comments No comments