Dave-H

Tried it out, it says that all of my SanDisk SSDs are unsupported!

Thanks, I added those entries and the error messages are gone! This is what I'm seeing now in HTTPSProxy - [23:28] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:5222] [23:28] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:443] [23:28] 003 [D] "GET https://news.google.com/news?q={searchTerms}&sourceid=opera&num=%i&ie=utf-8&oe=utf-8" 301 0 [23:28] 002 [D] "GET https://www.google.com/search?q={searchTerms}&sourceid=opera&num=%i&ie=utf-8&oe=utf-8" 302 315 [23:28] 001 [D] "GET https://www.google.com/search?q={searchTerms}&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest" 302 324 [23:28] 007 [D] "GET https://news.google.com/search?q=%7BsearchTerms%7D&sourceid=opera&num=%25i&ie=utf-8&oe=utf-8" 302 0 [23:28] 006 [D] "GET https://search.opera.com/?search={searchTerms}&global=no" 302 262 [23:28] 008 [D] "GET https://www.google.com/search?client=opera&q={searchTerms}&sourceid=opera&num=%i&ie=utf-8&oe=utf-8" 200 - [23:28] 009 [D] "GET https://www.google.com/search?client=opera&q={searchTerms}&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest" 200 - [23:28] 005 [D] "GET https://www.amazon.com/s/145-7872646-0478402?ie=UTF8&index=blended&keywords=%7BsearchTerms%7D&link_code=qs&tag=opera-20" 200 - [23:28] 010 [D] "GET https://www.google.com/sdch/4orahf3u.dct" 200 - [23:28] 010 ProxHTTPSProxyMII FrontProxy/v1.4 [WinError 10053] An established connection was aborted by the software in your host machine [23:28] 000 [D] SSL Pass-Thru: https://sync.opera.com:443/ [23:28] 004 [D] "GET https://com.com/" 200 - [23:28] 012 [D] "OPTIONS https://plex.tv/pms/:/ip None" 200 0 [23:28] 014 [D] "GET https://plex.tv/pms/:/ip" 200 15 [23:28] 013 [R][D] "GET https://plex.r.worldssl.net/announcements/announcements.json?cb=1538173710824" HTTPSConnectionPool(host='plex.r.worldssl.net', port=443): Max retries exceeded with url: /announcements/announcements.json?cb=1538173710824 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x03772FB0>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed',)) [23:28] 011 [D] "GET https://search.yahoo.com/yhs/search?hspart=Opera&hsimp=yhs-international&p=%7BsearchTerms%7D" 200 - [23:28] 000 [D] SSL Pass-Thru: https://www.google-analytics.com:443/ [23:28] 000 [D] SSL Pass-Thru: https://www.google-analytics.com:443/ [23:28] 000 [D] SSL Pass-Thru: https://www.google-analytics.com:443/ [23:28] 007 [D] "GET https://news.google.com/search?q=%7BsearchTerms%7D&sourceid=opera&num=%25i&ie=utf-8&oe=utf-8" 302 0 [23:28] 015 [D] "GET https://news.google.com/search?q=%7BsearchTerms%7D&sourceid=opera&num=%25i&ie=utf-8&oe=utf-8&hl=en-GB&gl=GB&ceid=GB:en" 200 - [23:28] 015 ProxHTTPSProxyMII RearProxy/v1.4 [WinError 10053] An established connection was aborted by the software in your host machine [23:28] 016 [D] "GET https://search.yahoo.com/favicon.ico" 304 - [23:28] 015 [D] "GET https://news.google.com/search?q=%7BsearchTerms%7D&sourceid=opera&num=%25i&ie=utf-8&oe=utf-8&hl=en-GB&gl=GB&ceid=GB:en" 200 - [23:28] 000 [D] SSL Pass-Thru: https://autoupdate.geo.opera.com:443/ [23:28] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:5222] [23:28] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:443] Still some apparent errors there, but nothing in the Windows logs. Cheers, Dave.

Yes, this is what I'm seeing in the HTTPSProxy console - [21:31] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:5222] [21:31] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:443] [21:31] 000 "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:600)" while trying to establish local SSL tunnel for [autoupdate.geo.opera.com:443] [21:31] 039 [D] "POST https://sync.opera.com/api/sync/command/?client=Opera&client_id=xxxxxxxxxxxxxxxxxx" 200 261 [21:31] 000 "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:600)" while trying to establish local SSL tunnel for [autoupdate.geo.opera.com:443] [21:31] 022 ProxHTTPSProxyMII FrontProxy/v1.4 [WinError 10054] An existing connection was forcibly closed by the remote host [21:31] 023 ProxHTTPSProxyMII FrontProxy/v1.4 [WinError 10054] An existing connection was forcibly closed by the remote host [21:31] 000 "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:600)" while trying to establish local SSL tunnel for [autoupdate.geo.opera.com:443] [21:31] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:5222] [21:31] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:443] [21:31] 000 "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:600)" while trying to establish local SSL tunnel for [autoupdate.geo.opera.com:443] [21:31] 041 [D] "GET https://easylist-downloads.adblockplus.org/easyprivacy.txt?_=1538166666207" 200 123845 [21:31] 040 [D] "GET https://easylist-downloads.adblockplus.org/easylist.txt?_=1538166666206" 200 637620 [21:32] 042 [D] "POST https://autoupdate.geo.opera.com/ 1037" 200 - [21:32] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:5222] [21:32] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:443][21:31] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:5222] [21:31] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:443] [21:31] 000 "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:600)" while trying to establish local SSL tunnel for [autoupdate.geo.opera.com:443] [21:31] 039 [D] "POST https://sync.opera.com/api/sync/command/?client=Opera&client_id=xxxxxxxxxxxxxxxxxx" 200 261 [21:31] 000 "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:600)" while trying to establish local SSL tunnel for [autoupdate.geo.opera.com:443] [21:31] 022 ProxHTTPSProxyMII FrontProxy/v1.4 [WinError 10054] An existing connection was forcibly closed by the remote host [21:31] 023 ProxHTTPSProxyMII FrontProxy/v1.4 [WinError 10054] An existing connection was forcibly closed by the remote host [21:31] 000 "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:600)" while trying to establish local SSL tunnel for [autoupdate.geo.opera.com:443] [21:31] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:5222] [21:31] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:443] [21:31] 000 "[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:600)" while trying to establish local SSL tunnel for [autoupdate.geo.opera.com:443] [21:31] 041 [D] "GET https://easylist-downloads.adblockplus.org/easyprivacy.txt?_=1538166666207" 200 123845 [21:31] 040 [D] "GET https://easylist-downloads.adblockplus.org/easylist.txt?_=1538166666206" 200 637620 [21:32] 042 [D] "POST https://autoupdate.geo.opera.com/ 1037" 200 - [21:32] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:5222] [21:32] 000 "[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:600)" while trying to establish local SSL tunnel for [push.opera.com:443] I guess this is the problem!

OK, I've found out what's triggering the error message, it happens now every time I run the Opera 36 browser. This is the last version which works on XP. I have sync enabled, and I can only assume that connecting to Opera's servers for this is causing the error message, but I have no idea why.

I'm now getting this intermittently in my Windows System log - Is this another certificates problem? The information in the data section of the error means nothing to me I'm afraid! I'm still getting problems in my Eudora e-mail program, despite using the certificate updater and HTTPSProxy. I had an e-mail from Plex the other day about some new offering, and it took literally nearly a minute to open in Eudora! The e-mails from Sky and Marks and Spencer only take about 30 seconds, but that's bad enough. They all look perfect once they're opened, but what could possible be taking so long to resolve when downloading them?!

Strange, the last update I've got that can't be removed is from 2010! I'm not sure why an update from 2013 is shown highlighted in that screen grab.

Thanks again Rudolph, yes I'll certainly give that a try if I'm still getting problems. I got a notification for your posts OK.

Thanks, I haven't knowingly changed my notifications for years, but I thought it was possible that the outage a few months ago might have scrambled things, so i checked, and it looks correct. Those are my settings, and they look like what I want, with a separate e-mail for every added post.

I got a notification for your post as well, but nothing for the previous eight before mine, but that may have been because I didn't visit the forum again until I next posted. Are the certificate errors you're seeing just about a name mis-match? If so, you can just switch those warnings off in the internet settings.

I've now set up a scheduled task to run @heinoganda's certificate updater automatically on Patch Tuesday every month. I'll leave the automatic updates turned off unless and until someone reports that it's fixed. I hadn't realised that they were doing the same thing anyway! When updates happen, is the old certificate information replaced with the new information, or will any old certificates that aren't in the new update remain on the system? Is anyone else getting e-mail notification from this thread BTW, as I don't seem to be, although I am getting them from other threads?

You've got me wondering now whether the notifications from MSFN do actually work that way! I know they do on some forums I subscribe to, but thinking about it I may well have had multiple notifications from the same thread in the past without having visited the thread.

I have both those entries in my Add/Remove Programs. Searching for the winusb.dll file brings up the same version (6.1.7600.16385) in system32, but there are copies of the file in two other folders relating to connectivity software for mobile phones, both my old Nokia phone and my current Samsung phone. The copy in the Samsung folder is older (6.0.6000.16386), the one in the Nokia folder is the same as the one in system32. If you have similar software installed that may well be where it came from.

It seems to be very erratic for me. I've had quite a few e-mail notifications during the last few days, but before that it seems I wasn't getting them as I checked to see if there were any responses to a post I'd made, and there were several which I hadn't been notified about! You don't get a notification for every post anyway, only for the first one since you last visited, but even that did not seem to have happened. Touch wood it's OK at the moment though, at least for me.

Thanks, so I guess switching off the automatic updating system and just using the manual updater when prompted (or on a regular schedule) is the answer. I'm actually quite relieved that this does not seem to be a problem just on my systems, and is actually yet another problem caused by Microsoft's flaky updates! Actually I've always been surprised that we're getting the automatic updates at all, but I assume this is for the benefit of "real" POSReady systems, which are still supported. If enough people with them complain about the endlessly logged errors, perhaps it will get fixed, but I'm not holding my breath!

Bizarrely, when I download authrootstl.cab now, its contents are dated 21st August 2018, which I don't understand at all! Still doesn't work though. Well if, as you say, the automatic crypt32 updates do exactly the same thing as @heinoganda's manual updater does, there is no point in using both. I guess as you say that what MS is serving through the automatic system is now just very out of date, and therefore throwing errors. Strange though that the automatic update system is still trying to do updates when the manual updater has been run, so the latest certificates should already be there! Were it not that this is presumably happening on "genuine" POSReady systems as well as hacked XP systems, I would say that it was something that won't be fixed, but if it's happening on supported system, it should be fixed! Mind you, look at how long it took them to fix the forever scanning Windows Update issue..........

Thanks, yes I was aware of the option to disable the function, although it probably hadn't been specifically mentioned in the thread. I was hoping to fix the problem though of course, rather than just working around it by disabling the function! If it proves to be a function that fundamentally no longer works on XP, I will switch it off of course, but I haven't quite yet given up on finding a fix!

Thanks, I'll look into that!

Thanks as always @heinoganda! I have run your batch file before, and done manual cleaning too, but clearing the certificate caches and deleting the certificates themselves only seems to work for a short time, and then the errors just come back again. I really don't want to get into effectively creating a new XP system to test whether this occurs again with that, it's a lot of trouble with no guarantee that it would reveal the source of the problem. It's happening on two completely independent XP installations on two machines, which would seem to indicate to me that it's pretty ubiquitous, even if not everyone seems to be seeing the errors. Fundamentally, it looks as if Windows Update is serving an out of date file to the system, which is throwing error messages because there are a lot of expired certificates in it. Deleting the expired certificates will not do any good of course, as they will just be downloaded again! Presumably there is an up to date version of the file being served to later versions of Windows, but I don't know what address it's coming from. If it was possible to find that out, it might be possible to change the Windows Update download address so XP and POSReady systems get the current version.

Well I've just manually downloaded authrootstl.cab and extracted the authroot.stl file from it. Looking at its contents, it dates from 22nd September 2017, so it's nearly a year old, and it contains a lot of long expired certificates! Why is Windows Update serving such an old version, and is it possible to change it to download the current version, even if it's not intended for XP systems? Presumably this problem must be happening on genuine POSReady systems?

Good, well that's three of us at least with the same issue! I'm sure he will correct me if I'm wrong, but I don't think running or not running Heinoganda's certificate updater has anything to do with these errors, as I think that updates something different to what the crypt32 updates are. As those crypt32 automatic updates are still happening, and were for ages after XP EOL before the errors started, they must be something different to what the certificate updater is designed to update, which is presumably something now no longer updated automatically by the OS. As I said, I've never run the certificate updater on my netbook, or done any other manual updates or alterations to any of the certificates system on that machine, and the errors have started there too, although they did take a lot longer to start appearing there than they did on my main machine for some reason.

A good thought, but I don't have Eudora installed on my netbook, so it can't be that!

Well my purging of the certificates on my machine didn't work. In fact I'm now getting so many errors on every boot that they're being suppressed to avoid swamping the log! I'm still really surprised that no-one else seems to be having this problem, as it's happening exactly the same on my netbook too, which has never had any changes made to its certificate system, it hasn't even had any manual updates applied using @heinoganda's updater or by any other means!

Yes, good to have the system working properly again finally, but why on earth did it take so long to do anything about it?! I fixed my .NET update problem by installing .NET 4 Extended, problem solved! Quite why I would need it I've no idea, but I have got it on my main machine anyway, I obviously never bothered with it on my netbook. I will have a look at that page Den mentioned. 🙂

Sorry for the delay in responding, I don't seem to be getting any e-mail notifications of replies again. Yes, I only have Client Profile installed on the machine with the problem, so that would certainly explain it!

Yes, I had to do that too! I also can't install KB4457046. It throws error 0x66A every time on Microsoft Update, and when I try the standalone installer, I get "KB4457046 does not apply, or is blocked by another condition on your computer." Anyone any ideas about that? I can't find any reference online to that specific problem. The other .NET 4.0 update installed fine.