[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

15 minutes ago, Dave-H said:

So is that 3rd October or 10th March?

Of course the 10th of March 2021. I'll send you missing certificates as soon as possible. I think they aren't unique, only made for my system. They are from Microsoft. And try method "Turning back time" at all costs!
 

Quote

everything worked fine, including Microsoft Update

But now Microsoft Update isn' t working anymore. You have to check all including status of all services. And please send me your screenshots listed by ServiWin. Comparing with help of your log file is too tiring.

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

1 hour ago, Dave-H said:

I've looked at that registry key, and unfortunately it's a date where I can't tell whether it's in American format or the sensible format that the rest of the world uses.
Do you know which it is? I'm guessing US format, but just wanted to be sure.

@Dave-H A little correction. I meant registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate and there the value of LastRestorePointSetTime. Here is my value: 2019-04-12 13:45:09. You see it's your English format. Try the point in time you have there first! Then you may try other points in time. The method "Turning back time" can mean to go back one year or one day. You just have to try out. It's trial and error. Maybe it works.

 

1 hour ago, Dave-H said:

Our Internet Options Advanced tabs are actually the same, sorry I had a "senior moment" there!
Both the 'Use HTTP 1.0' options are checked.

I'll forgive you due to your "senior moment". But where is the 'Use HTTP 1.0' option? I have only these entries: Use HTTP 1.1 and the Use HTTP 1.1 through proxy connections. If there wasn't both entries it had to be assumed that your Internet Explorer was not properly installed or is faulty. Anyway, look at last post of me above to download screenshots of my services in better quality.

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H Do you want me to upload these missing certificates via PM or not? Your decision. By the way I found out that on platform imgur images in jpg format have a bad quality due to strong compression. Therefore here a link of my two screeshots of all Microsoft services existing in my system listed by ServiWin but more readable plus all services in a txt file: https://www.mediafire.com/file/odq8y7iyx7i5kdf/Microsoft_services_-_AstroSkipper.7z/file

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H
Due to the fact that the Microsoft service HTTP-SSL was disabled in your system I think it is a good idea to compare our Microsoft services and their status generally to be sure all necessary system services are still working. There might be some services not being essential but anyway in my system Microsoft Update is working properly. To do that download the tool ServiWin 1.71 from NirSoft. Here is the homepage link: https://www.nirsoft.net/utils/serviwin.html and here the download link:  https://www.nirsoft.net/utils/serviwin.zip. It's portable so there is nothing to install. I've taken two screeshots of all Microsoft services existing in my system listed by ServiWin. Columns with German description have been faded out. So it's much easier for comparing. Here they are: https://imgur.com/az67Jo6 and https://imgur.com/bIQ2jIN.

 

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H What about the 5 missing certificates under Intermediate Certification Authorities? You didn't mention it.

In the next days I'll post another very interesting solution to fix your problem. I still have to work it out a bit. Of course if turning back time doesn't help! Now I'll go to bed. Cheers!

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H Maybe your Internet Explorer installation is faulty. Just a guess!

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

Here the DNS servers I suggested: Google Public DNS. 8.8.8.8. 8.8.4.4. and Cloudflare. 1.1.1.1. 1.0.0.1.
Try them!
And here's another fix referring to error code 0x80072f8f I have found while researching:
Open in a registry editor the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\LastRestorePointSetTime. Here you can see a date and a time (that's my idea to find a suitable point in time).
Now go back to this date and time plus for example one hour. Try to access MU. Reboot. Then adjust clock to current date and time. Do a synchronization. Reboot. Then try again!
The idea is to go back in time to the last successful update on MU web site and try to access the MU server. Some people had success with turning back time to solve error code 0x80072f8f.
And here a screenshot of my Internet Options - Advanced referring to HTTP settings: https://imgur.com/EHW7rix

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H Ok, thanks for further details! I have compared our lists of certificates intently. If you had compared our lists of certificates intently too you would have realized that only one of them is identical. And that is the list of certificates referring to Microsoft in Third Party Root Certification Authorities. But in my list of Intermediate Certification Authorities I have 8 certificates referring to Microsoft and you only 3. Have a look! That's a big difference. If wanted I can upload these missing certificates via PM so that you can import them under Intermediate Certification Authorities. As I told you two posts above expired certificates can still be required and in use too.

At last I have analyzed your Windows Update Log once again. Here the interesting lines:

2022-02-01    22:53:27:781    1856    9b0    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
2022-02-01    22:53:27:781    1856    9b0    PT      + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx
2022-02-01    22:53:28:796    1856    9b0    Misc    WARNING: Send failed with hr = 80072f8f.
2022-02-01    22:53:28:796    1856    9b0    Misc    WARNING: SendRequest failed with hr = 80072f8f. Proxy List used: <https=localhost:8080> Bypass List used : <<local>> Auth Schemes used : <>
2022-02-01    22:53:28:796    1856    9b0    PT      + Last proxy send request failed with hr = 0x80072F8F, HTTP status code = 0
.
.
.
2022-02-01    22:53:28:796    1856    9b0    PT    WARNING: GetConfig failure, error = 0x80072F8F, soap client error = 5, soap error code = 0, HTTP status code = 200
2022-02-01    22:53:28:796    1856    9b0    PT    WARNING: PTError: 0x80072f8f
2022-02-01    22:53:28:796    1856    9b0    PT    WARNING: GetConfig_WithRecovery failed: 0x80072f8f
2022-02-01    22:53:28:796    1856    9b0    PT    WARNING: RefreshConfig failed: 0x80072f8f
2022-02-01    22:53:28:796    1856    9b0    PT    WARNING: RefreshPTState failed: 0x80072f8f
2022-02-01    22:53:28:796    1856    9b0    PT    WARNING: Sync of Updates: 0x80072f8f
2022-02-01    22:53:28:796    1856    9b0    PT    WARNING: SyncServerUpdatesInternal failed: 0x80072f8f
2022-02-01    22:53:28:796    1856    9b0    Agent      * WARNING: Failed to synchronize, error = 0x80072F8F
2022-02-01    22:53:28:796    1856    9b0    Agent      * WARNING: Exit code = 0x80072F8F

As we already know Microsoft Update 0x80072f8f error code means ERROR_INTERNET_SECURE_FAILURE ErrorClockWrong. What does it really imply in your case? You can see it in your Windows Update Log. Look at bold text! A client fails to contact its server. In your case client is your computer and server is Microsoft Update Server. Request sent from your computer to MU failed. Synchronizing of client and server failed. Getting configurations failed. That' your problem. What is the conclusion? The connection and synchronization failures between client and server have to be fixed. At first we have to think about what we've already restored and fixed. The Windows Update Agent looks fine and you have reported that all steps of my post "Manually reset Windows Update components (KB971058)" have been performed:

Have you performed step 4 too or have you skipped it as recommended?

Quote

If this is your first attempt at resolving your Windows Update issues by following the steps in this article, you should skip step 4 and go to step 5.

If you skipped step 4 then it should be catched up. Furthermore I added another registering of a DLL component: in step 6:

Quote

And the following added by me (@AstroSkipper):
regsvr32.exe mssip32.dll

Perform this registering to complete step 6.
Now some settimgs: Go to IE Internet Options, Advanced and click to select the Use HTTP 1.1 and the Use HTTP 1.1 through proxy connections check boxes if not already selected.
Next check if system service HTTP-SSL has system been started. If not start it and set it to Auto Start.
Now reboot your computer, try to access MU again and post your Windows Update Log.
If these tips don't solve the problem I have another one: Change your DNS servers to Cloudflare or Google and check if it helped. I use often DNS servers of Cloudflare but at the moment the servers of my provider.
So far from me today!

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H I've read an interesting article of a person who had same error code and the solution was a missing certificate in a chain of certificates. Check if following certificate exists under Trusted Root Certification Authorities: GTE CyberTrust Global Root valid until 14.08.2018. I know it has expired but I've read that such expired certificates can still be in use. It's just a try.

Furthermore I've found another tip that obviously others had helped:

Quote

Adding the program WuauClt.exe into the exception list of firewall fixes the 0x80072f8f problem in some cases.

And one more question: Do you have a normal installation of XP or are you running it in a VM? Is your computer a clent or server in a network or a stand-alone one?

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H Yesterday I had trouble to access Google and other web sites using HTTPSProxy. What had happened? I checked and found out that HTTPSProxy's cacert.pem was faulty. I downloaded a new one manually from this link https://curl.se/ca/cacert.pem and copied it in HTTPSProxy's program folder. I deleted all certificates in certs folder and after starting the proxy I could access all sites without any problems. Updating cacert.pem in SysTray menu is working again. So what is the teaching of that? You have to check and deeply too. Comparing two files only due to size and date is not enough. A binary comparison is necessary or comparing hash values. You can do it for example with Total Commander. So download a fresh cacert.pem from link above and compare it to yours just to be sure your certs are valid and proper in your HTTPSProxy's program folder. Here is a screenshot of my Intermediate Certificate Authorities (there are Microsoft related certificates too): https://imgur.com/G2ogHnj
I don't know if they are relevant, they seem to be expired. And here my Third Party Root Certificate Authorities: https://imgur.com/vY3dnq8
What is your current time server? And please upload a new WindowsUpdate.log! Maybe something has changed.
A lot of Windows users have reported getting error code 0x80072f8f due to activation problems. So my next question. Is your Windows XP Professional properly activated? Do you have Windows Genuine Advantage (WGA) Validation Tool installed and what is your version? As far as I know the latest version for XP is 1.9.40.0. And I know a lot of questions. Sorry!

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

16 minutes ago, Dave-H said:

I already have Autoruns installed, although the self-protection module might fight it.
As it was that which gave me grief before I'm a bit apprehensive, but i'll give it a go!

Don't be afraid. I use Autoruns since 1995. It's from Sysinternals i.e. from Microsoft. It's totally safe. And there is nothing to install, it's portable. Make exclusions to Malwarebytes! 

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H A proper user agent is very important to let a web site working correctly providing all services for a visitor. Your user agent is bit strange and especially your entry "BTRS111060". My IE 8 user agent is "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; "Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 2.0.50727; .NET CLR 3.5.30729). You can see an absolutely clean UA string. Now there are two ways to change the UA string in Internet Explorer 8: editing registry entries or using an addon called UAPick. Here is the link: https://www.enhanceie.com/ietoys/uapick.asp and download link: https://www.enhanceie.com/dl/UAPickSetup.exe
Here more information about IE UA strings and related registry keys: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/ms537503(v=vs.85)?redirectedfrom=MSDN, https://www.heelpbook.net/2014/useragents-on-internet-explorer-registry-workaround/ and this one https://admx.help/?Category=Windows_8.1_2012R2&Policy=Microsoft.Policies.InternetExplorer::Customized_UserAgent_String.
By the way browser modes have been provided since IE8 to help developers fix issues quickly by telling a site to render like a previous version of the application. You can find it in developer tools -> browser modes.
In my opinion using UAPick is much easier and safe. I had installed it years ago and you can deactivate it  or uninstall whenever you want. Install it, backup your current UA string and then override it using my  IE 8 user agent. Then try to access MU again. Hope will never die!

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

11 hours ago, Dave-H said:

How do I set it back to the original user agent string?
Having never knowingly changed it from the default, I've never done it, in fact I didn't know that you could change it on IE without an add-on!
As for #7 on the list, switching the Windows firewall off has never made any difference, and I really don't want to uninstall Malwarebytes as I seem to remember it was a bit of a problem to get working properly in the first place! You said you never got it working properly, but it does seem OK for me at the moment and I don't want to mess it up. I think if it doesn't help switching off all its scanners, uninstalling it completely is clutching at straws a bit.
This has to be a certificate problem surely? Either a needed certificate is missing, or one that is installed is incorrect or invalid.

I didn't say you should uninstall Malwarebytes I suggested to deactivate all autostart components and services by using Sysinternals Autoruns (portable tool, lists all autostart entries) with the effect that after restarting no module of Malwarebytes is in RAM any longer. This can be reverted easily without harming your installation. Only a few clicks. Due to your Windows Firewall here another screenshot of my ICMP-Settings: https://imgur.com/9iqJdDP
And your are right either your error code is caused by SSL problems reading certificates or unsuitable settings in your system. And you see we have already found a lot.

Here I've uploaded for you the latest XP compatible version of Autoruns. More recent versions don't run under XP.
https://www.mediafire.com/file/m4b2khdjjjfvlic/Autoruns_v13.98.zip/file

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

1 hour ago, Dave-H said:

What the 'BTRS111060' bit is I have no idea, and researching it doesn't help. It seems that "BTRS" followed by a number is not uncommon in UA strings, but what it actually is seems to be rather vague to say the least! One suggestion was something to do with Bluetooth, but I think that's rather unlikely in my case!

@Dave-H Maybe BTRST - The Braintrust Token? The Braintrust Token is an ERC-20 token issued on the Ethereum blockchain network by the Braintrust Technology Foundation, a nonprofit foundation. Perhaps you had got some adware in the past but anyway. Backup your user agent if needed in the future and set it back to original one just for testing purpose! Or use an addon to manage user agent strings! Here a link:
https://www.howtogeek.com/howto/18450/change-the-user-agent-string-in-internet-explorer-8/
And what about item 7 of our list?

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

11 hours ago, RainyShadow said:

Go to this page https://msfn.org/board/attachments/

You can remove old uploads to free some space.

For images it is better to use external sites though. I normally use imgur.

@Dave-H So with the help of @RainyShadow (Thanks once again!) I found out that I have an overall size limit for uploading of 1.95 MB and a Max total size of 512 KB. Truth be told these limits would have been fantastic in year 1985 if there had been an internet but in this day and age unsuitable and counterproductive to help people by uploading screenshots. Therefore I've removed all attachments substituted by links and follow the advise of @RainyShadow using imgur for image uploads. For other files I'll use a hoster. Attachments only in case of emergency or size is not exceeding 1 byte!

@Dave-H Any news about getting rid of error code 0x80072f8f?

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

52 minutes ago, maile3241 said:

I actually had a problem with Chrome Frame in W2k. After that, Internet Explorer stopped working properly. Try uninstalling Chrome Frame.

@Dave-H I totally agree to @maile3241. You have to uninstall Chrome Frame for testing purpose. I do not have Chrome Frame installed in my system. And restore your original user agent (maybe Chrome Frame is the causer).
 

Quote

I'm slightly puzzled as to why your window is labelled "Internet Options" and mine is labelled "Internet Properties".

Maybe it is another version of IE or screenshot taken from Win 2000. So it doesn't matter. In Internet Explorer 8 it is labeled "Internet Options".

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

50 minutes ago, maile3241 said:

I have 3 vms running on my pc. Would it be possible to run ProxhttpsProxy outside of the vms so that you don't have to open the program individually in the vms?

I do not run vms in my system. My Windows XP Professional is non virtual but a real one. Maybe you ask one who is running vms too. As I said some posts above there is no need to run ProxhttpsProxy in most cases. Nevertheless I think it should be possible to run one instance in your basic system if supported to provide a HTTPSProxy connection for a vm. Maybe there is a possibility to configure your vm to use this basic HTTPSProxy connection. But just a guess! Never done before!

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

4 minutes ago, RainyShadow said:

Go to this page https://msfn.org/board/attachments/

You can remove old uploads to free some space.

For images it is better to use external sites though. I normally use imgur.

Thanks a lot! I will do that. Could not find any documents about posting and upload limits in this forum.

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

21 minutes ago, Dave-H said:

Is 45kb the limit on the size of each file, or an overall limit?
Surely not the latter!

As far as I can see it is an overall limit. At the beginning of posting here I had an overall limit of 512 kb. I don't understand the reducing. Maybe you can find out what the upload size limit is and why it has been reduced.

I see in commenting zone Max total size: 45.22 kb. Will it be resetted daily or weekly or never?

21 minutes ago, Dave-H said:

Is there any reason to use ProxHTTPSProxyMII instead of it?

No, only for testing. HTTPSProxy is more comfortable, isn't it? Did you update cacert.pem? I hope so.

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

13 minutes ago, Dave-H said:

I have the second HTTPSProxy entry, but not the first one.
How do the paths of your two entries compare?

@Dave-H The first entry is related to ProxHTTPSProxy and the second one to HTTPSProxy. You know I have both in my system.

I found a list with all error codes. Here is the link: http://inetexplorer.mvps.org/archive/wuc.htm

And there you can find:

Error Code: 0x80072F8F

Dec Error Code: -2147012721

Error String: ERROR_INTERNET_SECURE_FAILURE ErrorClockWrong

Description: One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server.

I wanted to upload more screenshots but I have a size limit of 45 kb. No chance! Is that normal?

 

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

12 hours ago, Dave-H said:

No difference, still error 0x80072F8F.

Ok, item 1. to 6. checked and done. Very good. Important is item 7. I found this on a web site due to error code 0x80072F8F:

Quote

Spent a lot of time with Windows Online Support yesterday. The fault
was that Update was calling upon a file directly rather than going
through my proxy server, and was getting stopped by a firewall. Have
now made a hole in the firewall to accommodate the call.

Therefore we have to compare the Windows Firewall settings too.

https://imgur.com/a/OEfex0j

 

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

@Dave-H 

Due to the fact we have to check what else you have missed check following items:

1. Tls 1.2.reg was applied successfully. Important is reg key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
   "DefaultSecureProtocols"=dword:00000a80
2. Check if still correct patched wuaueng.dll version exists in both folder system32 and system32\dllcache. If you have SFC enabled Windows is able to swap it by an other one. In my system SFC is disabled.
3. Be absolutely sure you have taken the suitable config.ini for HTTPSProxy. I have provided two of them, one for HTTPSProxy and one for ProxHTTPSProxy.
4. Check Trusted Zone if only the three provided urls related to Microsoft exist. That's very important. I've already mentioned this several times but no statement from you.
5. Check your Internet Zone too, maybe lower restrictions i.e. lower security level. I've already mentioned this several times but no statement from you.
6. Clear SSL State and Personal information once again. I've already mentioned it above.
7. Did you try to access MU by disabling MalwareBytes and firewall completely? I've already mentioned this but no statement from you.

I do this list for you to be sure you haven't missed one of them.

When you reply to this do it in the way item 1 checked and so on. So I know what is done and what has to be done.

If none of necessary steps was missed you would be able to access MU without any problems. So what the hell is missing? Check it!

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

6 minutes ago, xpandvistafan said:

directory

I think you mean registry key it isn't a directory. But thanks for tip! We have to check all again and again and again.... 

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

1 hour ago, Dave-H said:

I've replaced it now with yours, and the error is now back to the one about the clock being wrong again

Now do this once again:

Quote

Check in your registry if the key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate doesn't exist otherwise delete it.

Open system panel, click Automatic Updates and check if it is not greyed out. Then select Turn off Automatic Updates.

Open Internet Explorer on the Tools menu, click Internet Options.

Under Advanced check if check for server certificate revocation is unselected.

Then click the Content tab. Under Certificates, click Clear SSL State. Click OK when you receive the message that the SSL cache was successfully cleared.

Under Personal information, click AutoComplete. Under Clear AutoComplete history, click Clear Forms. Click OK when you are prompted to confirm the operation. Click Clear Passwords.

Click OK when you are prompted to clear all previously saved passwords, and then click OK two more times.

Close Internet Explorer.

Start HTTPSProxy and then Internet Explorer.

Try to access Microsoft Update one more time.

Post your Windows Update Log again.

And what is about your time server?

[On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019]

2 minutes ago, maile3241 said:

I found out that Firefox only works when ProxhttpsProxy is closed

Newer browsers do not need HTTPSProxy or ProxhttpsProxy. I use these tools only for accessing web sites using IE or IE engine. Some programs use IE looking for updates or providing other services. Same for email clients. Most of the time HTTPSProxy is disabled in my system.