CAPI2 Errors in Event Viewer

Topic

New Reply

There are suddenly repeated CAPI2 errors in Event Viewer.

“Failed extract of third-party root list from auto update cab at: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab with error: The certificate is not valid for the requested usage.”

Any ideas on possibly causes and solutions?

Thank you.

Reply | Quote

Replies

Link is download of .cab file

Reply | Quote

anonymous wrote:

The certificate is not valid for the requested usage

This implies a certificate is involved either in the download or the file itself.
What is the file for?

cheers, Paul

Reply | Quote

“Link is download of .cab file”

My level of knowledge and understanding is limited. I would need help step by step in any troubleshooting.

“This implies a certificate is involved either in the download or the file itself.
What is the file for?”

I am guessing just whatever Windows does behind the scenes. I just know I have never seen CAPI2 errors in Event Viewer before so it seemed like something that might needed to be looked into.

When I do a CAPI2 search in Event Viewer I also find an entry that predates the errors by some hours saying “Successful auto update of disallowed certificate list with effective date: Friday, March 15, 2019 2:00:23 PM.” so I don’t know why errors are also listed after that saying “Failed extract of third-party root list from auto update cab”.

Thanks.

Reply | Quote

I’m also getting CAP12 errors. I didn’t have them before the March updates so I’m assuming it has something to do with those updates.

Don't take yourself so seriously, no one else does
All W10 Pro at 22H2,(2 Desktops, 1 Laptop).

Reply | Quote

“I’m also getting CAP12 errors. I didn’t have them before the March updates so I’m assuming it has something to do with those updates.”

Thanks for sharing that CADesertRat. I was wondering if it was related as mine started right after doing the March security only updates.

I had a few errors (under errors, not warning or information) for CAPI2 for a couple of days with the above mentioned “Failed extract of third-party root list from auto update cab at: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab with error: The certificate is not valid for the requested usage.” Do you have those also?

Those went away for the past couple/few days for me now but if I enable CAPI2 logging then there are numerous errors shown on many different actions like opening a game, windows explorer, etc. from consent.exe and MsMpEng.exe
saying things like “The revocation function was unable to check revocation because the revocation server was offline.”, “The form specified for the subject is not one supported or known by the specified trust provider.”, “A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.” Same for you?

Reply | Quote

I Googled authrootstl.cab and it appears that its security certificate expired in September 2018.

Reply | Quote

My PC is getting a CAP12 error 11 in Win Vista Starter 32 bit OS — Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab&gt; with error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.Any solution?

(Authrootstl.cab file is attached)

Reply | Quote

Do you have any details of the error message, or the un-trusted certificate?

cheers, Paul

Reply | Quote

<!–more–>The Windows Update Error Code is  – 800B0109 for 8 Important Updates & 2 Optional Updates – All related to ,Net Framework 4.6 –
KB4014984 , KB3210142 , KB3195382, KB3188744, KB3179949, KB3136000, KB3142037, KB3143693, KB3136000, KB3164025.
It may be noted that Windows Update picked up 2 updates with same number KB3136000.

(see the screenshot attached)

Reply | Quote

Check the update log.
Press Win R, then type (or copy/paste): %windir%\Windowsupdate.log

The latest changes are at the bottom of the log.
You can post a section with the error if you need help interpreting.

cheers, Paul

Reply | Quote

WindowsUpdatelog is attached. Since these 10 Updates were causing problems, these were set aside as Hidden.



Difficult to interpret what exactly has gone wrong.

 

 

Reply | Quote

That is not the update log, it’s a list of install status. We need the log files themselves.

cheers, Paul

Reply | Quote

Well, upon — Press Win R, then type (or copy/paste): %windir%Windowsupdate.log –this is all one can get — see the attached file.

WindowsUpdate-1
The error 800B0109 is a Windows Update error…pertaining to some certificate. One may have to dig deep to the dates in the month of April 2020 around 12th..or..so… for log when Windows updates were failing with this error. I have set those updates aside as hidden so that PC works without these updates. The cab file which is not getting downloaded via Windows update is getting downloaded manually from the link that fails due to this error. Then also, the problem is not getting solved. Those 10 updates will fail.

Reply | Quote

The updates seem happy.

Try the “fix it myself” section of this MS web page.

cheers, Paul

Reply | Quote

Did – Fix it Myself – steps. For a moment it seemed it did the job. But when run Windows Update to check those 10 failed updates…. first it gave an error 80070002. Then after sfc check (no errors found) and restart it gave error 800B0109. Something tells me … that Fit-it Myself – solution worked but presence of something else is jeopardizing the whole good effort.

Also, in event log (event 20) — Installation Failure: Windows failed to install the following update with error 80070643: April, 2017 Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.5.2, 4.6 on Windows Vista SP2 and Server 2008 SP2 (KB4014984)—-

Otherwise, the event log is full of — event 11 error — Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab&gt; with error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.—

I think a re-install of OS is the only alternative… And if error persists, related to .net 4.6 framework updates, then it may have something to do with some root certificate or what is often referred to as CTL … I don’t know how to set that … if wrong.. Why MS must keep issuing certificates … is a big question.

Reply | Quote

Bindesh wrote:

Why MS must keep issuing certificates

All certificates have an expiry date or are revoked for other reasons, so MS update them when required.

cheers, Paul

Reply | Quote

Bindesh wrote:

Failed extract of third-party root list

Can you hide the update that is causing that error and see if everything behaves without it?

cheers, Paul

Reply | Quote

Set aside those 10 Windows update  as Hidden —

And then restarted the computer and checked Event Log — full of Even 11 Error …Failed extract of third party rootlist…

Reply | Quote

This is a radical solution, but it might work.

1. Download the manual update from Microsoft.
2. Disconnect your PC from the internet.
3. Change the date of the PC to 2010, via Control Panel.
4. Run the update downloaded in 1.
5. If you still get invalid certificate errors, try moving the date forward 2 years at a time.

cheers, Paul

p.s. It might be worth checking your MS certificates for expiry (Win R, certmgr.msc).

Reply | Quote

Tried as instructed. Upon downloading those 10 Win Updates manually, it turned out to be 19 updates in total — KB3078601, KB3188735, KB3195788, KB3210129, KB4014561, KB3179930, KB3189051, KB3195363, KB3210139, KB4014559, KB3136000-V2, KB3142037, KB3143693, KB3164025, KB3179949, KB3189052, KB3195388, KB3210136, KB4014553.

Out of these 19 updates,  4 updates – kb3078601, kb3188735, kb3195788, kb3210129 – – Not Applicable for this system.

KB4014561 got installed manually.

5 Updates related to .Net 4.5 fr — KB3179930, KB3189051, KB3195363, KB3210139, KB4011559 — failed as blocked by another condition on your computer or not applicable to this system.

9 Updates related to .Net 4.6 fr — KB3136000-V2, KB3142037, KB3143693, KB3164025, KB3179949, KB3189052, KB3195388, KB3210136, KB4014553 – Installation did not succeed. A certificate chain could not be built to a trusted root authority.

Changing date /time from 2010 and up by 2 years till 2020, did not result in any further progress.

And how to check certificate ? —

 

Reply | Quote

You should only have installed one patch, the certificate update Windows6.1-KB3004394-v2-x64.msu, from the MS site linked in my post.

cheers, Paul

Reply | Quote

Sorry. It is not understood.

Windows6.1-KB3004394-v2-x64.msu is for Win 7 with 64 Bits.

My Computer OS is Win Vista Starter 32 Bit.

Request confirmation before I proceed.

(Attempted manual updates — KB2677070 & KB2813430 — are not applicable to this system.)

Reply | Quote

Choose the 32 bit version.

cheers, Paul

Reply | Quote

Attempted to install manually Windows6.1-KB3004394-v2.msu– This update is not applicable to this system – for 2010, 2012, 2014, 2016, 2018, 2020.

Reply | Quote

And in continuation from above —

Are outdated certificates to be deleted? Or there are updates to be found?

 

Reply | Quote

It is normal to have expired certificates in your store.

Try this manual update method.

1. Download the update file from Microsoft.
2. Double click on the “authrootstl.cab” file you have downloaded.
3. Copy the “authroot.stl” file to a temporary location.
4. Right click on “authroot.stl” and select “Install CTL”.

Let us know if that works.

For more information see this page.

cheers, Paul

Reply | Quote

As per instructions, installed authroot.stl . Attempted to run Windows Update. Got error 80070002. Stopped Windows Update Services and deleted contents of SoftwareDistribution folder. Started Windows Update Service and Restarted computer. Run Windows Update. Got error 800B0109. What to do ?

Reply | Quote

We have gone full circle so my only suggestion is to make a full backup and reinstall W7.

cheers, Paul

Reply | Quote

How would it be to skip these 10 Updates and continue with Win Vista Starter 32 bit? There are no other issues. What are these 10 updates — all related to .Net 4.5 and 4.6 or so….

May I dare to say that even MS does not know what it gave as updates and what it took away as rollups… security and vulnerability scare…. in a hurry to wind up Vista … messed up in .Net frameworks… and left you and me .. high and dry … trying to figure out what went wrong….

What guarantee is there that we may not face a similar issue in Win 7 ? That is also — no support from MS.

And Win 10, you already know better….

Awaiting your response. Shall we do the dare?

Reply | Quote

Sorry, I’ve only just noticed you are running Vista, that must be one old machine.
If you don’t need to run Microsoft software and want a more secure system I would try something like Lubuntu – you can download a live CD and test without having to install.

cheers, Paul

Reply | Quote

An alternative to Windows OS but looks and user friendly interface similar to Windows XP,Vista,7 is what I was looking for my old computer. Windows/MS and IT industry keep changing things so quickly that we are unable to keep pace with it. I hope your suggestion — Lubuntu — is worth a try. Thanks to you and this forum – AskWoody.

Reply | Quote

I shall checkout Lubuntu … but it may take some time to get familiar with it. In the meantime,  do the dare — continue with Vista.  Or, lets say – MS comes up with Win 12 (already in the making, I assume) and it has all that it takes….We close this thread….there is nothing further to it. Thanks.

Reply | Quote