This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi, I get this error in the last few weeks and I am not sure, whether I should do something about it. I went to TechNet, Event ID 11 Automatic Root Certificates Update Configuration, but I would need something simpler that I can follow. Confuseduser P.S. Exact error message is below: -
Log Name: Application
Source: Microsoft-Windows-CAPI2
Date: 27/05/2009 8:42:16 PM
Event ID: 11
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Helga-PC
Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />
<EventID Qualifiers="49154">11</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-05-27T10:42:16.000Z" />
<EventRecordID>32381</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Helga-PC</Computer>
<Security />
</System>
<EventData>
<Data>http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</Data>
<Data>A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
</Data>
</EventData>
</Event>
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
I don't see any reason the solution above would not work in Vista. I see the same folder structure and registry entries on Vista.
If you are not familiar with the registry, here is a very detailed instruction set on how to delete entries: http://support.microsoft.com/kb/136393
Be sure to use the export option before deleting entries in order to back them up.
This does help.
Now that you've pointed this out I've seen the same behaviour in the CAPI2 Event Viewer log file. My Windows 7 clients have been trying to access two URL's at the domain http://crl.microsoft.com/
None of the posts I had seen on this had mentioned the need for this path.
Thanks,
Michael
hi
Here's a basic definition for CRL in general terms. You can search Google using "Certificate Revocation List" and find a lot more information.
it could also be that direct X is looking for some updated drivers
what happens is that your browser is checking for provoked certificates , is perfectly normal and safe , its to keep you safe
have a nice day
ps for some further info
http://technet.microsoft.com/en-us/library/dd772269.aspx
Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs+ Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
If you're running a virus program, you must allow it to load the update.
Hi all.
I hope this thread still have some readers. After all, the solution is not there yet, it seems.
I run Vista Home Premiun and update everything I can from Wndows. I can see that I have had the error since june 3, so the timing is the same as yours. I have just opgraded to service pack 2 a few days ago. So the error is not related to this update specifically.
I think that some more attention should be paid to this part of the error message: "A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file."
I am not a Windows guru, but I have had 11 years as SAP supporter on a fairly high level. And based on this experience I would think that the actual description in the error text should make it possible for a Windows guru to perform a simple test with different date/time settings. In SAP you should never ignore what the system itself tells you are wrong. Perhaps it is also the case with Vista.
I first really noticed the problem when I resently installed version 9 of IOLO's System Mechanic. Then I started getting erros like "Acces violation at address 1339A131 in module 'IOLOSM~DLL'. Read of address 00000004". I have not (yet!?) seen this error message after I reinstalled the System Mechanic program. But the certificate error persists.
To me the Microsoft Responces look a lot like the first-level answers you get from SAP too. Very helpfund and friendly supporters look at all ther existing internal notes and send some of them them to us. But apparrently they have not set up a test environmelt to reproduce the error message. Hopfully they will do that in the end. With such a clear message and with such nice users who are willing to help with all the experiments it should be possible to reproduce the error and then find the solution.
What is this thing?!? And, has anyone found a way of getting rid of it? I have followed about 5 steps listed on this forum by "technicians" and I still keep getting this error. I have noticed others have logged events and were able to determine the cause, but no errors appear in the logging for me -- only in the event viewer.
From what I know about it CAPI2 is the Crypto API of Windows. It looks like the CTL (Certificate Trust List) Microsoft currently offers on their update sites is broken (invalid signature). So Windows does not accept it for security reason. If Windows would accept it, then anybody could forge a fake certificate trust list and inject it which would open an attack vector for intruders.
Most probably the error is simply triggered by any application using SSL connections with the help of the crypto API (CAPI2). So the first application using the API might trigger the (still pending since id did not succeed) CTL update which fails each time because the CTL provided by Microsoft is invalid.
On some machines the error does not occur. This might be related to the fact that some people switch off WU or did not apply some patches. I noticed that the certificate revocation list update is an optional update on Windows Update which I usually apply to all machines. Maybe this triggers the problem. Installation of SP2 might trigger it too because it might contain a related update.
In some cases enabling CAPI2 logging helps to find the process which actually triggers the CTL update. This might allow you to disable it. In my case it was the "Windows Media Player Network Sharing Service" which is a Microsoft built-in service. Disabling (or setting startup type to "manual") made the CAPI2 error to disappear on my machine.
What irritates me is the fact that it seems the CAPI2 error completely disappeared from my system logs. So my statement above might not be true in any case (first application using crypto API triggers the error). Maybe the error is triggered only if CAPI2 is invoked too early at the boot stage (when starting services). Unfortunately you might not be able to fix it if an antivirus program (which needs to run as a service on system boot) triggers the error too early.
I think we made a lot of good conclusions and findings in this thread. It's now about Microsoft to fix the issue.
