Microsoft-Windows CAPI2 failed extract of third-party root list from auto update cab

Finally addressed here-

http://support.microsoft.com/kb/2328240

I tried the workaround recommended in that MSKB article, and after that my Win2008 server will not boot. Be very,very careful if you plan to try the workarounds from that MSKB article on production servers...

October 6, 2010  OS: Vista x64 Ultimate

On my system, The earliest entry in Event Viewer for CAPI2 Event ID 11 errors is July 11, 2010. Since that date Event Viewer shows 725 instances of that particular error.

Following many days of research I tried the solution recommended in Microsoft KB2328240 (http://support.microsoft.com/kb/2328240).

NOTE: KB2328240 leaves out something very important. I believe you need to right click on Command Prompt and select "run as administrator".

KB2328240: To resolve the problem, follow these steps: Open a command prompt. To do this, click Start, click All Programs, click Accessories, and then click Command Prompt*(should be right click Command Prompt and select run as administrator)* . At the command prompt, type the following command, and then press ENTER: certutil -urlcache * delete

For clarification:  certutil (space) -urlcache (space) * (space) delete

Afterward, I saw this as the last line in the command prompt window:  CertUtil: -URLCache command completed successfully

After reboot, Event Viewer showed that the CAPI2 Event ID 11 error still occurred. I noted the time I logged into my account and the error event time stamp showed the event had taken place before my logon. My conclusion at that point was that the error must be related to a System account and not my user account.

I checked the file locations specified in KB2328240 and all of the folders still had nothing in them (empty folders).

The next solution I tried was Kevin Zhao's that is posted here:

http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/685e65f6-72a7-4986-b02c-f17e8be78926

Abbreviated version of Kevin Zhao's solution:

Based on my research, the issue can be caused by corrupted certificate data on the server. I suggest you try the following steps to test the issue:

1. Backup and delete the contents of the following folders:

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData

2. Backup and delete the certificates listed under "Certificates" key:

HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates

Then, restart the server to check the result.

Since I had already deleted the contents of the two folders he referenced , I opened registry editor and exported a backup of all the subkeys under \AuthRoot\Certificates. Then, I deleted all of the subkeys as per his instructions.  After I rebooted the system, Event Viewer showed that the CAPI2 Event ID 11 error still occurred, again before I logged on.

I was tempted to give up at that point but decided to try again one last time. I checked the folder locations specified in KB2328240 and they were still empty so I opened registry editor again to HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates. There were three certificates listed as subkeys which I deleted (Oops, should have read KB293781 first).  

I didn't reboot the system this time. Instead I ran the following executable, again after right clicking on it and selecting run as administrator:

Update for Root Certificates Aug 2010 KB931125

rootsupd.exe (331 KB)

Version: 931125, Date Published: Aug 23, 2010

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=f5eff286-5412-4d7f-81b2-3a1418a4f8b9

Next, I synced the system clock and then rebooted. After logon, I let the computer run until the drive activity light went out. When I checked Event Viewer there were no CAPI2 Event ID 11 errors listed in the time period after I restarted the system. I expanded the Windows Logs section and selected Application. Upon scrolling down, I saw an Information level entry for CAPI2 with the following result:

Successful auto update of third-party root certificate:: Subject: <CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US> Sha1 thumbprint: <E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46>.

Final Thoughts:  Everything about the CAPI2 errors seems to point to an invalid root certificate.  As I'm sure everyone knows by now, Event Viewer shows the following for CAPI2 Error ID 11:

Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

I clicked on the link and downloaded the authrootstl.cab file. Extracting authroot.stl from the cab file and opening it gives the following:

Certificate Trust List - General Tab

Certificate Trust List Information

This certificate trust list is not valid. The certificate that signed the list is not valid.

Subject usage  Root List Signer

Effective date  Monday, July 19, 2010 4:15:54 pm.

When I click on View Signature I see the following:

Digital Signature Information

The certificate is not valid for the requested usage

Name: Microsoft Certificate Trust List Publisher

Click on View Certificate in that dialog box, then select the Details Tab.  It shows that the certificate is Validfrom Thursday, April 08, 2010 and Validto Friday, July 08, 2010.

The certificate trust list is not valid because it expired on July 08, 2010.  Many of the forum posts I looked at regarding CAPI2 error events reference a date shortly after July 8,2010 as when their CAPI2 errors began.  In my case, the earliest date I had CAPI2 errors was July 11, 2010. What puzzles me is why the cert wasn't updated after so many people reported CAPI2 errors. Perhaps it's because it didn't really cause any problems outside of an error event showing up in Event Viewer.  

In my case, after eliminating this error, my system now loads in half the time it did before. Previously it took Vista over 3 minutes to load. Now it loads in 1:30. Considering I spent about 500 minutes solving this problem, it will take quite awhile before I make up that time. Of course, there is also the possibility that the CAPI2 events had no bearing on my system load times. Oh well.

fix posted here at Microsoft here is link works 100% http://support.microsoft.com/default.aspx?scid=kb;en-us;2328240