Microsoft`s Silent Trusted Root Authority update is Invalid?

I was going though my Event Log today and spotted over 5000 CAPI2 (Crypto API) Errors, generating anywhere from 5-20 new errors every hour going back to November it seems...

After some quick checking it seems the Trusted Root Certification Authority list is not updating correctly :huh:

For anyone who doesn't understand what the Trusted Root Certification Authority List is about or why this list is a crucial cornerstone of everyday internet use heres a excerpt from Microsoft`s documentation:

Root certificates are updated on Windows XP, Vista and all earlier versions of Windows automatically. When a user visits a secure Web site (by using HTTPS SSL), reads a secure email (S/MIME), or downloads an ActiveX control that is signed (code signing) and encounters a new root certificate, the Windows certificate chain verification software checks the appropriate Microsoft Update location for the root certificate. If it finds it, it downloads it to the system. To the user, the experience is seamless. The user does not see any security dialog boxes or warnings. The download happens automatically, behind the scenes.
Root certificates are also delivered for Windows XP and earlier. Root Updates are cumulative, so it should only be necessary to install the latest one to receive all root certificates in the Program.
Whether a user, or “relying party”, should trust a root certificate for any particular purpose can be a difficult question. CAs must be on guard against issuing certificates to people who put them to bad use, such as signing malicious software to make it seem more acceptable. CAs should have effective revocation policies and procedures to adequately deal with such certificates. Also, users are expected to scan a CA’s Certificate Practice Statement (CPS) before deciding to trust a certificate - to ensure that acceptance would not cause undue risk to a user’s security, for example. Such documents can be hundreds of pages long though, making user trust decisions complex. Microsoft’s role is to assess CAs and qualify them according to the Program requirements before enabling distribution of their root certificates.

Basically, Microsoft periodically updates the list with the latest Certificate Authorities used for Verifying the SSL certificates used by your bank, ebay, paypal and thousands of other websites using SSL certificates and also updates the list of banned certificates being used for Malware, fraudulent websites or other certificates being misused (Like these two: VeriSign issues false Microsoft digital certificates)


The latest Update can be downloaded here (URL from the Event Log): http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

After opening the AuthRootstl.cab file you can see the Authroot.stl update list where you can see the latest Trust List Update information...

It seems however that the last Certification update Microsoft released on the 4th of November 2008 was signed using an invalid Internal Windows Code Signing certificate :eek:

Not only did Microsoft use the wrong Certificate to sign the Update, the Trust list of updated certificates itself (viewable from the second tab then under Certificate list) has a few hundred invalid and missing CA entry's :eek:

Interestingly, when I downloaded this list on Windows 7 it had an equally destroyed Update List signed at 11:50PM the night before the Vista Update List was signed the next day at 9:50AM, they both have the same hash and thumbprint but have different signing dates (How is that even possible? ) There is also no information about the CAPI2 errors found in the Windows 7 event-Log...

It begs the following questions:

1: Why hasn't this problem be reported by anyone, anywhere else before I spotted it?

2: If the Trusted Root Update did manage to update your local system is it safe to assume the entire system`s Root Certification Store is more or less 'compromised' meaning every website using SSL, every e-mail using signing, encrypted file or anything and everything using a certificate issued by a Trusted Root Certification Authority can no longer be guaranteed or verified on your system? (affecting every Version of Windows including Windows 7)

3: Since its accumulative does that mean all current entries are overwritten with each new update? (incase a system did get this failed update is it ok to continue using without having to format the system?))

4: How does the certificate signing timestamp change between Windows 7 and Vista for the same download?

5: Why does the latest Manual update only support XP? (It seems to install but it doesn't display any information about Vista support or even if it installed sucessfully) (https://www.microsoft.com/downloads...0e-ee7e-435e-99f8-20b44d4531b0&DisplayLang=en)

6: Since theirs no CAPI2 related event-log information on Windows 7 does this mean this update is being installed on Windows 7 successfully or failing silently?

7: How did this pass their internal testing guidelines before whomever reasonable was able to release it and why hasn't it been fixed in nearly two months?

Can anyone else confirm what I have mentioned or does anyone have some more information, thoughts or ideas about this problem so I can report this to Microsoft?

Steven

(P.S. Merry Christmas for yesterday and Happy New Year for next week )

 

[tasaholic]

While that is a possibility, I would Google the issue to see if others have this issue and what the "fix" was. Nothing in the computing world is ever as simple as we first think,hence the need for Techs.:huh:

 

[JMH]

On this link other people are discussing the same error.

I have subscribed to the RSS / feed.

I wonder if it could be related to DRM?

Decided to elevate you to Senior Detective Submarine.

 

[Submarine]

Tried to install KB931125. This generated the following message in the application Log:

Fault bucket 9165836, type 5
Event Name: PCA2
Response: None
Cab Id: 0
Problem signature:
P1: rootsupd[1].exe
P2: 6.0.2600.0
P3: Win32 Cabinet Self-Extractor
P4: Microsoft® Windows® Operating System
P5: Microsoft Corporation
P6: 1
P7: 201
P8:
P9:
P10:
Attached files:
C:\Users\Submarine\AppData\Local\Temp\{00b00edd-0281-4531-b4b5-63c8a34916ac}\appcompat.txt
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Report097d34d8

Do not think this helped with the problem much.

 

[Submarine]

The error has disappeared yet I have WMPNetworkSvc running and have not installed any updates since the attempt above. Either this fixed the issue, or it it because I have played around with the Media Player settings, or a fixed certificate has been isued.

Do you still have the problem?

 

[JMH]

When was your last error message?

The Cap12 error hasn't been recorded in event vwr here for the last couple of days. [ a big improvement ]
However on checking authroot - the Digital Cert Info still reads "The cert. is not valid ............................"

 

[Submarine]

The last error was on the fift. What do you mean with checking authroot? Where do you check that?

 

[JMH]

The last error was on the fift. What do you mean with checking authroot? Where do you check that?

Just noted that one CAP12 error was recorded yesterday.

Re authroot - got to orb - type in authroot - & voila you have it.
See what your details say.

 

[Submarine]

Are you sure you are not seing the file you downloaded from the Event Viewer? That is the only one that shows when I search, sitting on the desktop. I turned off everything in Tools-Options-Library tab-Configure sharing in Media Player. Don't know if that did anything, but I have not had any error since.

 

[JMH]

Are you sure you are not seing the file you downloaded from the Event Viewer? That is the only one that shows when I search, sitting on the desktop. I turned off everything in Tools-Options-Library tab-Configure sharing in Media Player. Don't know if that did anything, but I have not had any error since.

Yep, you are right of course.

 

[Peppurr101]

Hello,
I am seeing the same error, and have been for a while, in my event viewer but my computer seems to be working fine. The posts above have me confused. Is this an issue I need to address or is it something that will sort itself out?
Thanks

 

[Sinclair]

As far as I know there’s nothing to be worried of. I also had the event CAPI2 logged after every bootup in the past and, to have it stop showing up, I changed the Cryptographic Services Startup Type from default Automatic to Automatic (Delayed Start).

 

[JMH]

Hello,
I am seeing the same error, and have been for a while, in my event viewer but my computer seems to be working fine. The posts above have me confused. Is this an issue I need to address or is it something that will sort itself out?
Thanks

My computer is working well also.
Am I worried? No.
Confused as to why it is so? Yes.
Curious as to why it hasn't been dealt with? Very curious.

 

[Peppurr101]

My computer is working well also.
Am I worried? No.
Confused as to why it is so? Yes.
Curious as to why it hasn't been dealt with? Very curious.

That describes the feeling exactly!
:D

 

[jgveill]

Vista reports a problem with time, so I looked on that side. After few trials, I was able to get rid of the CAPI2 event ID 11 errors and also able to get them back ! Here's the story :

- I first tried to set my Vista clock one year earlier (no change in BIOS): no success, CPI2 errors were there. System event viewer also reported that my time was not properly set.
- I tried to set the Bios date earlier ( Sept 16 2007 ) (Vista time properly set). No success CAPI2 errors were there.
- I tried to set both Bios and Vista clocks to Sept 16 2007 and ... no more CAPI2 errors.
- I set correct time in Bios and Vista and CAPI2 errors were back. It looks like both the Bios and Vista clock are involved in the check.

Additionnaly, I noticed a huge difference in boot time. As an example, time difference between the first and last boot information in Application Event Viewer is 2 min 29 sec. with CAPI2 errors and is .... 21 sec. without CAPI2 errors. No need to say I would prefer the second one, booting time is always too long !

Additionnally, during the trials, I noticed that Windows update was asking to check updates ... after checking updates, none was reported available even if I know one was waiting for couple of days. After correctly setting time, I could effectively see the waiting update.

So, Vista and Bios with earlier time solves the problem but it's just not possible the keep a PC with wrong time. Updates are also not possible.

Now, I'll wait experts thoughts and possible solutions, because it could really be fun to get rid of these errors and minimize boot time. Thanks

Jean

 

[Submarine]

My error disappeared for good after the changes I did with with Media Player. Don't need it.

 

[jgveill]

Windows Media player sharing options have no effects on my side.

 

[Submarine]

Vista reports a problem with time, so I looked on that side. After few trials, I was able to get rid of the CAPI2 event ID 11 errors and also able to get them back ! Here's the story :

- I first tried to set my Vista clock one year earlier (no change in BIOS): no success, CPI2 errors were there. System event viewer also reported that my time was not properly set.
- I tried to set the Bios date earlier ( Sept 16 2007 ) (Vista time properly set). No success CAPI2 errors were there.
- I tried to set both Bios and Vista clocks to Sept 16 2007 and ... no more CAPI2 errors.
- I set correct time in Bios and Vista and CAPI2 errors were back. It looks like both the Bios and Vista clock are involved in the check.

Additionnaly, I noticed a huge difference in boot time. As an example, time difference between the first and last boot information in Application Event Viewer is 2 min 29 sec. with CAPI2 errors and is .... 21 sec. without CAPI2 errors. No need to say I would prefer the second one, booting time is always too long !

Additionnally, during the trials, I noticed that Windows update was asking to check updates ... after checking updates, none was reported available even if I know one was waiting for couple of days. After correctly setting time, I could effectively see the waiting update.

So, Vista and Bios with earlier time solves the problem but it's just not possible the keep a PC with wrong time. Updates are also not possible.

Now, I'll wait experts thoughts and possible solutions, because it could really be fun to get rid of these errors and minimize boot time.

Windows Media player sharing options have no effects on my side.

Indeed system time has been suggested to be involved in this issue. I do not know if you have read the thread linked by me on the 27th of June above. It contains a lot of useful information. This is how to enable CAPI2 logging in the Event Viewer:

"Go to Applications and Services Logs\Microsoft\Windows\CAPI2\Operational in the event viewer. Right click and enable logging for this service. Then give the log about 10 minutes to log stuff. You should get some informational logs and then some errors. Open the error and click the details tab. Scroll down and it should at least tell you the process that is causing the error."

 

[jgveill]

Thanks Submarine for the answer.

Yes I read the whole thread and Yes I enabled CAPI2 log to have more information. The 3 errors were all related to trust certificate, time validity, etc ... and all three were initiated by Avira's sched.exe. As I was reluctant to disable or change Avira, so I posted my message hoping we could find something else than removing Avira. Now I did some additional tests ...

I disabled sched.exe and as you can imagine errors disappeared. It was predictable, the call is coming from Avira. Between you and me, removing the "initiator" doesn't mean we found the real culprit !

I just hope that another Antivirus scheduler will work. We'll see.

Thanks again

 

[Submarine]

Hmm, I remember I had some odd recurring error. It went away after I flashed my BIOS and immediately after restart installed some program. Cannot remember what it was, if it was SP1, or if it was a re-installation of McAfee. It was related to system time somehow.

Anyway, good luck!

 

[JMH]

I subscribe to the MS feed on this topic. The problem continues to be discussed, speculation on causes are many, the "techs" offer various "solutions" & yet the problem still remains.
[dmex started this thread on 26-12-08 ,a long time ago, & things still haven't changed.]
For anyone who wants to persue the topic further it has been suggested to use this link.
https://connect.microsoft.com/default.aspx