This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi, I get this error in the last few weeks and I am not sure, whether I should do something about it. I went to TechNet, Event ID 11 Automatic Root Certificates Update Configuration, but I would need something simpler that I can follow. Confuseduser P.S. Exact error message is below: -
Log Name: Application
Source: Microsoft-Windows-CAPI2
Date: 27/05/2009 8:42:16 PM
Event ID: 11
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Helga-PC
Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />
<EventID Qualifiers="49154">11</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-05-27T10:42:16.000Z" />
<EventRecordID>32381</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Helga-PC</Computer>
<Security />
</System>
<EventData>
<Data>http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</Data>
<Data>A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
</Data>
</EventData>
</Event>
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
I don't see any reason the solution above would not work in Vista. I see the same folder structure and registry entries on Vista.
If you are not familiar with the registry, here is a very detailed instruction set on how to delete entries: http://support.microsoft.com/kb/136393
Be sure to use the export option before deleting entries in order to back them up.
This does help.
Now that you've pointed this out I've seen the same behaviour in the CAPI2 Event Viewer log file. My Windows 7 clients have been trying to access two URL's at the domain http://crl.microsoft.com/
None of the posts I had seen on this had mentioned the need for this path.
Thanks,
Michael
hi
Here's a basic definition for CRL in general terms. You can search Google using "Certificate Revocation List" and find a lot more information.
it could also be that direct X is looking for some updated drivers
what happens is that your browser is checking for provoked certificates , is perfectly normal and safe , its to keep you safe
have a nice day
ps for some further info
http://technet.microsoft.com/en-us/library/dd772269.aspx
Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs+ Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
I have the feeling that there is nothing wrong in our computers but thatit happened on Microsoft server sites, where a published list of certificate is not valid.
I think you are completely right here. When I open the Certificiate Trust List it immediately presents a warning/error:
Certificate Trust List Information
This certificate trust list is not valid. The certificate that signed the list is not valid.
Then click on "View Signature" and you will get another error displayed:
Digital Signature Information
The certificate is not valid for the requested usage.
Clicking on "View Certificate" reveals the following:
Certificate Information
This certificate is not valid for the selected purpose.
In the "Details" tab under "Key Usage" it reads "Digital Signature (80)" and the icon has a yellow exclamation mark.
Going to the "Certification Path" tab shows the following path:
Microsoft Root Certificate Authority
Microsoft Certificate Trust List PCA
Microsoft Certificate Trust List Publisher
The last one seems to be the guilty one (see above properties).
Going one step down to the "Microsoft Certificate Trust List PCA" certificate it shows the following in the "Key Usage" field: "Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)" and it has a green arrow within the icon (compared to the yellow exclamation mark of the Microsoft Certificate Trust List Publisher certificate).
I've verified this on two Vista machines - one of them does not show the CAPI2 error.
So it seems that the "Microsoft Certificate Trust List Publisher" certificate is broken and contains wrong key usage flags.
Tabagaras, you face another issue I am afraid.
The lack of update of root certificates should imho not have immediate impact: this will be gradual and the ones that will be complaining the most to MS will be e-governement, merchands, etc. For the end user, it would require at the worst manual installation of root certificate authorities.
What puzzle me is the fact that the error message happens at each boot time, prior to opening a network connection (WIFI in case of notebooks), which seems to indicate that an automatic update has downloaded and cached <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
Still the online file itself is indeed not fixed at this stage by Microsoft.
Philippe
I have the feeling that there is nothing wrong in our computers but thatit happened on Microsoft server sites, where a published list of certificate is not valid.
I went to <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab > manually, and tool the "authroot.stl" certificate file inside: when you double click on it to view the certificate, it indicates "Cette liste de certificat de confiance n'est pas valide. Le certificat qui a signé la liste n'est pas valide." (which I can translate in EN as "This list of trusted certificates is invalid. The certificate that did sign the lsit is not valid."
And indeed, looking at the certificate that signed the list, it appears that it is a certificate is still not in the validity period but is not declared as valid for performing such an action (signing a list of root certificates).
I believe the problem will be resolved when Microsoft will realize about the glitch and will fixed the certificate located at this URL (and in that sense, OUR POSTS MIGHT HELP).
Until then, I am afraid that we should live without trying to have 100% error-free VISTA event managers. I noticed no side effect in the way applications behave, except the error message.
Philippe
No side effect?
I'm not sure if it's because of this error or if I also have some other issues but something halts my computer while starting into a white screen for time that variates between a few seconds and ten minutes. Is anyone else having this? Someone mentioned blue screen during start-up.
