windows 7 certificates error

[andy_nic]

i have a problem i've done a clean install of windows 7. but now when i access any website or service that needs to access a certificate. it rejects it saying it is invalid. but they are vailed. because they work on other computers fine. just not my windows 7, my colleague did a upgrade from vista to windows 7 and his is fine.

 

the error is "this certificate cannot be verified up to a trusted certification authority"

Edited January 5, 2010 by andy_nic

[PHolland]

currently searching for a solution to this aswell

 

from what i have found windows 7 needs to veryify certificate chains with the windowsupdate website directly via port 80, when you are locked behind a RBC internet connection with only filtered access via a proxy this seems to fail as it doesnt use the IE proxy settings properly

[RichB]

its to do with your secruity in ie8, had the same problem I ended up re-installing the ie but the below KB should help

 

How to use security zones in Internet Explorer

[andy_nic]

currently searching for a solution to this aswell

 

from what i have found windows 7 needs to veryify certificate chains with the windowsupdate website directly via port 80, when you are locked behind a RBC internet connection with only filtered access via a proxy this seems to fail as it doesnt use the IE proxy settings properly

@PHolland, i think your right that is what i have found too, but i didn't know that its because of the proxy.

[jpyeates]

I am also having this problem.

 

I have contacted the ISP to see if anything can be done thier end. I know they have made proxy exceptions before for stuff like the LA VLE?

 

The trusted sites option is only a short term work around as you cannot set every site you want to view as a trusted site? Unless there is something i've missed here?

[andy_nic]

I fixed it Partly help by timg in this post http://www.edugeek.net/forums/windows-7/49233-not-getting-windows-7-updates.html when he said about

netsh

winhttp

proxy proxyname.myschool:Port

exit

however i couldn't get this to work i did. open cmd type "netsh" then "winhttp" then " set proxy "insert proxy address"

 

 

Andy

[DrCheese]

Hi,

You shouldn't need to set the netsh stuff, as it will use the logged in users proxy settings.

However, you do need to make sure that you allow unauthenticated access to a few URL's, namely.

 

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 

 

You may also need to allow access to the CRT/CRL of whoever issued your SSL certificate, in our case the top level cert was from "usertrust" Looking at our proxy logs revealed a ton of access denied for

 

http://crt.usertrust.com/AddTrustUTNSGCCA.crt
http://crt.usertrust.com/AddTrustExternalCARoot.p7c

 

Check your proxy logs for hits on "CRT" and "CRL" if you have another provider.

 

It must be allowed unauthenticated access as it doesn't send the username to the proxy when it tries to download these.

 

The reason for this is is that Windows 7 doesn't have the certs, or expired certs for a fair few providers out of the box. On Windows XP you used to download an update every few months with new certs "Windows root certificate update" which would allow these to work, But Windows 7 no longer has these, instead it reaches out across the Internet and downloads the authrootstl.cab above from Windows Update whenever it gets a cert it doesn't understand.

[Stuart_C]

Had the same issue with my SmoothWall proxy. Needed to add some addresses into my "do not auth" list.