CAPI2 Errors

[Mcd73165]

Hi. I just got finished speaking to support at Microsoft and I might as well have been talking to a wall! I got transferred like 5 times and then got someone with such a heavy accent that I barely understood a word he said. I previously e-mailed Microsoft and clearly explained the problem and even uploaded the faulty authrootstl.cab file for them to see. There response was just sending me in circles back to where I started. Therefore I made the call. Anyhow, the guy said that the problem should be fixed in a few days but I don't know what the cause of the problem is because the guy was so hard to understand even though I asked him a few times. If the problem is ultimately resolved I'll be amazed. Unf'ing believable. I'll post the outcome next week. I'm not keeping my hopes up too high. Mark

 

[Mcd73165]

Hi, all. It has been nearly 5 days since I spoke to Microsoft about my CAPI2 4107 errors issue due to invalid trust list certificates from their download site and as I expected, they were just giving me lip service (from the few words that I was able to understand) as they haven't fixed the problem. I may e-mail them again but it will probably be a waste of time (again). I have attached a faulty Certificate Trust List.

 

[cluberti]

I'm not sure what you can do about this, short of opening a real Microsoft case (not a free one) and get your money back afterwards. Sounds like whomever you were talking to probably don't actually work for Microsoft anyway.

 

[Mcd73165]

I'm not sure what you can do about this, short of opening a real Microsoft case (not a free one) and get your money back afterwards. Sounds like whomever you were talking to probably don't actually work for Microsoft anyway.

Thanks, Cluberti. I'm not going to pursue this issue any further other than possibly sending Microsoft another e-mail. All I know is that I needed an interpreter to help me understand whoever I spoke to at Microsoft. Again, thanks for your input.

 

[Mcd73165]

I e-mailed Microsoft again over the weekend about my problem and my dissatisfaction on the way it's being handled. I got an e-mail from Microsoft today saying something to the effect that the problem is a Windows 7 Operating System problem and not a Windows Update problem and I was given another link to Microsoft Support. When inputting the information required in this link it said I would have to pay for support on this issue. No way am I going to pay!

I e-mailed the guy at Microsoft back and told him that I feel I'm just getting a runaround and no way will pay for support on this issue. I believe that the problem is on their end and that they should fix it. Actually, this is the e-mail that I got from them today:-

Dear Mark, Thank you for contacting Microsoft Windows Update Support. My name is Alex, and I am glad to work with you. For your reference, the case ID for this service request is SRX1159723041. You can contact me directly by sending an email to [email protected] with the case ID in the subject line. From the problem description, I understand that Invalid Trust List Certificates had CAPI2 4107 errors and it said "The certificate that signed the list is not valid". Please feel free to let me know if I misunderstood. I understand the inconvenience you have experienced. Please be assured that I will do my best to resolve the issue. Mark, I would like to explain the current support team is Windows Update support team and we focus on update installation issue. As the problems about Invalid Trust List Certificates, please understand that it is related to the Windows System rather than Windows Update. We provide support for Windows Update issues and our Windows 7 issues are directly handled by the Windows 7 Support Team. This will ensure that our System Issues will be handled promptly. Therefore, we will need to start up a new incident so that the right Support Professional can work with you closely in the most timely and efficient manner. Please submit additional support questions by creating a new incident at the Online Support site. For your convenience, we have included the following link for the Windows Support Department: Assisted Support Options Thank you for your understanding. Please try my suggestion and let me know the results at your earliest convenience. Thank you for your effort and patience. I'm waiting for your reply. Have a nice day.

This was my reply:

Alex, I got your e-mail and don't understand what's going on. When I called Microsoft originally they said it was a Networking problem. You're saying that it's a Windows System problem. This whole thing sounds like I'm getting a run-around. When I go to the link that you provided me and enter my PID # it says that I will be charged for support. No way am I going to pay for this support. All I know is if I go to this website http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab and download the Certificate Trust List, it is invalid and has been since July 8, 2011. That is the reason for the errors. Who is responsible for fixing this and why should I have to pay for the support to have it fixed? There is nothing wrong with my Operating System.

I know that there were quite a few people that were having this problem in 2010 and no one said anything about having to pay to have it resolved. Most said that Microsoft Support was contacted and that the problem was resolved and others said that the problem seemed to resolve on its own after awhile. If I have to I'll simply live with the problem but whoever is responsible for this certificate trust list error should fix it. Thanks, Mark Unless they take care of this issue I'm not going to pursue it any further. Thanks for listening. Mark

 

[Phone Man]

You get an update and the update group says its not their problem.
Did Google buy Microsoft???
What a bunch of AH's.

Jim

 

[Mcd73165]

You got that right, Phone Man. As I said earlier in this thread, I could get more help talking to a wall rather than Microsoft support.

 

[Mcd73165]

Here is the latest on this ongoing saga. I got an e-mail from Alex at Microsoft today (8/18/11) and he said something like he hasn't heard back from me since he sent me the original e-mail which I did reply to (see my post above). I replied to him again with all the info I already sent to him. This whole thing is going from bad to worse. Let's see what happens assuming he gets and reads my reply e-mail this time. Meanwhile, I'm getting the CAPI2 errors up the wazoo!

 

[Mcd73165]

Hi. The reason I'm continuing with this thread is mostly to vent the frustration that I'm having with Microsoft support. I got a reply from Alex at Microsoft today (8/21/11) in response to the last e-mail I re-sent him. Here is his (almost useless) reply: (quote)From your description, I understand that you download the Certificate Trust List and it is invalid. Mark, I would like to explain the current support team you contact is Windows Update support team and we focus on update installation issue. As I said Windows System problem was related to Windows system and we need to involve a system support engineer. If you think the problem is related to network error, we need to contact your Internet Service provider to help you. Thank you for your understanding. You know I only focus on update installation issue. Thank you for your effort and patience. I'm waiting for your reply. Have a nice day. (unquote) This was my reply to him: (quote)Alex, this is ridiculous! The faulty certificate trust list is downloaded from a Microsoft link which once again is this link: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab. I never said that I thought it was a network error. The guy at Microsoft that I spoke to is the one that said it was a networking error which I told him didn't make any sense. Then he told me that it would be fixed in a few days which was a lie as I suspected it was. If Microsoft is responsible for these root certificate lists then why can't someone there at Microsoft take care of this problem? This is absolutely the worst support I have ever gotten from anyone, anywhere. Totally unprofessional! If no one there is willing to address this issue and without charge then I can live with this problem. However, my opinion of Microsoft support is totally negative. I can probably get more help if I talk to a wall. Between e-mails I've sent and the call to Microsoft that I have made, a lot of my time has been wasted for an issue that I'm sure could have been fairly easily resolved from the appropriate department at Microsoft. This is not a Windows 7 system problem. If I'm wrong about any of my assumptions then I will certainly apologize.(unquote) This issue probably won't be resolved and as I mentioned in an earlier post in this thread that I'm not going to pay for support on this problem. If by the rare chance the CAPI2 errors are fixed by Microsoft, I'll post at that time, otherwise I'm through here. Thanks for listening. Mark

 

[Phone Man]

I have gone to the workaround by turning on the CAPI2 Operational log so the errors will not show up in the summary. You can control the size of that log and I can check every week or so and see if the problem is resolved. Out of site and out of mind.

Jim

 

[Mcd73165]

I have gone to the workaround by turning on the CAPI2 Operational log so the errors will not show up in the summary. You can control the size of that log and I can check every week or so and see if the problem is resolved. Out of site and out of mind.

Jim

That's certainly an option. Mark

 

[mjf]

These errors have frustrated others and MS took forever to provide a fix which doesn't appear to solve your problem.
This thread is not your solution but just example that your frustration has been shared.
http://www.sevenforums.com/windows-updates-activation/98380-capi2.html

McAfee has been accused in the past as being one cause.
After I installed SP1 I never had the CAPI2 reporting problem.
Maybe just ignore them. Event logs clearly have a purpose but if they get full of rubbish you can clear them
http://www.sevenforums.com/tutorials/25480-event-viewer-one-click-clear.html

 

[wunderteam]

I developed Event ID 4107: CAPI2 errors at the precisely same time as the initiator of this thread. These errors became much more frequently after I installed SP1, switched Antivirus programs from McAfee to BitDefender, and upgraded to IE9. The log of CAPI2 also identified the system program lsass.exe as having a security certificate issue as well as consent.exe (system program), dwm.exe (system program) and SeaPort.exe (Windows Live program):

lsass.exe, 80092014 The certificate is not in the revocation server's database & 800B0109 A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
consent.exe, 80092013 The revocation function was unable to check revocation because the revocation server was offline.
SeaPort.exe, 800B0101 A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
dwm.exe, 80092013 The revocation function was unable to check revocation because the revocation server was offline.
​

The invalid certificate associated with authrootstl.cab when attempting to manually install from http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/ is apparently a red herring:

As for the certificate status, it is marked as "invalid for this purpose" because the UI expects a different EKU rather than the one used by automatic root update. The CTL UI expects the signer to contain the Microsoft Trust List Signing EKU. However, the automatic root update mechanism uses a different EKU (Root List Signer) and as part of certificate chain validation, Windows checks for the presence of the Root List Signer EKU in the CTL signer chain. In this case, the chain is valid for the Root List Signer EKU. (see Event Log CAPI2 4107 and CAPI2 errors driving you crazy? - THE OFFICIAL BLOG OF THE SBS "DIVA").
​

Thus the Event ID 4107 error message “A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file” refers to problems identified above rather than the integrity of authrootstl.cab itself.

It is not clear how serious Event ID 4107: CAPI2 actually is. Perhaps this error is just a consequence of overly paranoid system “nanny-ware” or of Rube-Goldberg-type convoluted security measures. Since no resolution to this issue appears to be imminent, the nuclear option of reinstalling the entire system seems the only solution. This will (hopefully) also improve the greatly degraded boot performance that I have experienced after a year of Win 7 use. Full scans by McAfee, BitDefender, Malwarebytes and MS Safety Scanner have not revealed any signs of infection. Kudos to Mcd73165 for braving the MS chicane and sparing us some additional frustration.

 

[Mcd73165]

Wunderteam, thank you very much for your input and kind words.

 

[Mcd73165]

I hope I'm not being premature but I think I finally resolved this problem, at least for my case. This link, Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server does not include the CryptnetUrlCache for 64Bit systems which is located in C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptNetUrlCache\Content and C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptNetUrlCache\MetaData. After (once again for like the 5th time) following the procedure in the Microsoft fix link above and also deleting the CryptNetUrl cache in C:\ Windows SysWow64, I rebooted several times to confirm there were no more CAPI2 Errors. I'll post again after I definitely confirm this fix is valid after a day or so. I'll keep my fingers crossed! (I found this information about the Wow64 Cache while frantically searching for a fix. I don't want to take credit away from whoever originally figured this out. I can't seem to find the link again where I got this info from).

 

[mjf]

I hope I'm not being premature but I think I finally resolved this problem, at least for my case. This link, Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server does not include the CryptnetUrlCache for 64Bit systems which is located in C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptNetUrlCache\Content and C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptNetUrlCache\MetaData. After (once again for like the 5th time) following the procedure in the Microsoft fix link above and also deleting the CryptNetUrl cache in C:\ Windows SysWow64, I rebooted several times to confirm there were no more CAPI2 Errors. I'll post again after I definitely confirm this fix is valid after a day or so. I'll keep my fingers crossed! (I found this information about the Wow64 Cache while frantically searching for a fix. I don't want to take credit away from whoever originally figured this out. I can't seem to find the link again where I got this info from).

It did for someone else
http://www.sevenforums.com/windows-updates-activation/98380-capi2-3.html#post976001

Meaning of a black hole: Send a suggestion to MS to improve something.

 

[Phone Man]

I hope I'm not being premature but I think I finally resolved this problem, at least for my case. This link, Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server does not include the CryptnetUrlCache for 64Bit systems which is located in C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptNetUrlCache\Content and C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptNetUrlCache\MetaData. After (once again for like the 5th time) following the procedure in the Microsoft fix link above and also deleting the CryptNetUrl cache in C:\ Windows SysWow64, I rebooted several times to confirm there were no more CAPI2 Errors. I'll post again after I definitely confirm this fix is valid after a day or so. I'll keep my fingers crossed! (I found this information about the Wow64 Cache while frantically searching for a fix. I don't want to take credit away from whoever originally figured this out. I can't seem to find the link again where I got this info from).

It did for someone else
http://www.sevenforums.com/windows-updates-activation/98380-capi2-3.html#post976001

Meaning of a black hole: Send a suggestion to MS to improve something.

I am getting to old for this. I remember that fix and for some reason I thought it was included in the MS FixIt but I was wrong. It worked last time and it worked again this time. I have now saved the FixIt file and a text file with the missing cache location. Maybe next time (and there will be a next time) I will get it fixed the first time.

Jim

 

[Mcd73165]

MJF, it was the CAPI2 link that you provided that led me to the solution. Apparently, some of you already went through this mess back in 2010. So far there have been no more CAPI2 errors on my machine. This whole thing then with the invalid trust list certificates which I thought were the sole cause of my problem was then related to some bad entry in the SysWOW64 CryptNetUrlCache. This is a bit above my level of understanding.

 

[Mcd73165]

I e-mailed Microsoft Support (for whatever it's worth) telling them that they should update their Fix It link Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server to include Windows\SysWOW64 CryptNetUrl entries for 64 Bit systems. This will save a lot of people a lot of aggravation if this CAPI2 4107 error problem is ever encountered. Thanks to everyone that provided input to this thread.

 

[mjf]

Hopefully MS will take include the addition.