Dave-H

Thanks. I'm away from home at the moment, back on Thursday, so I will give it a try then.

Ah yes, sorry more confusion from earlier on!

That link won't work for me either. It Looks like KB968730 was replaced by KB3072630, which I also have installed already. My version of crypt32.dll is 5.131.2600.6459, the same as yours.

That link doesn't work as it stands. I guess you have to be a member? I downloaded KB968730 from elsewhere anyway, it is the SHA-2 update I think? Thanks, but again I already have it installed.

Thanks, but that appears to be an update for the Windows MSI Installer. I'm not sure what that would have to do with Windows Update. I already have it installed anyway.

Ah thanks, I didn't spot the reference to it in that post! I did download it then, which is why I recognised the file's icon, but I can't remember whether I ever actually used it. Certainly everything that it does was checked and implemented manually anyway.

Yes thanks, I found that. Unfortunately, everything he did to fix it, I've already tried, in some cases several times, and it didn't fix it!

I've just been reviewing the earlier posts, and I was wrong when I said that nobody else had reported my problem. @xpandvistafanreported exactly the same problem here. I don't know if they found a fix, but I'll search some more!

I'm sure I had it before, I recognise the icon, so I assumed I had used it! You've made me doubt now.

OK I'll give that another go. Thanks for the link to winUpRestore!v28 BTW. Is that the same version I used before, or a later one? I can't remember! I'm pretty happy now that there is nothing wrong with my Windows Update software installation, I don't think it would get as far as it does if there was. It falls at the very last hurdle as far as I can see. If "an update certificate" means the certificate of a specific update, that would imply that an available update has been detected, which I feel is actually pretty unlikely now. It's more likely to mean a server certificate I would have thought.

It's here.

OK, scratch that theory then! I'm wondering about the error message saying "an update certificate". Does that mean the certificate of a particular update, or a general server certificate? I know my computer clock is 100% correct, I know my root certificates are 100% up to date. The pages I've found about the 0x80072F8F error sometimes cite a "defective proxy server" as being the culprit, but we are both now using the same local proxy server with exactly the same settings. I wish it was possible to access Microsoft Update now on XP without a proxy server, but it isn't of course. I've tried online proxy servers replacing HTTPSProxy, but then the site doesn't work at all, presumably because of the lack of the TLS 1.2 support that HTTPSProxy provides.

Yes, it was very disappointing! I'm really not going to go through everything again or do a new installation just to try and fix this. It's a huge bonus just to have the Microsoft Update site display at all again, and allow me to see my update history in it. There will of course be no more updates for XP anyway, or any of the other XP-compatible Microsoft software I have installed, like Office 2010, so there really is no point anyway in having Microsoft Update working fully again. The only reason to need it would be for updating a new installation, and I'm never going to do that unless there's an absolute disaster with my present installation. The thought of installing it all again from scratch, including the POSReady updates, fills me with absolute horror! I do ISO backups every week of my Windows 10 installation using the built-in Microsoft backup utility, but for Windows XP (and Windows 98) I just do a file copy backup of the drives. Maybe I should get the necessary software to do ISO backups of them too. I certainly don't have a backup from when Microsoft Update last worked! Why it doesn't work for me is still a mystery of course, and I would love to know what the problem is, but I think we've done as much as we can now. Whatever the problem is, it doesn't seem to affect anything else! I actually suspect that the problem is not what we think it is, Microsoft error messages are notorious for not really identifying the real problem! It must be related to certificate validity I'm sure, something in the certificate chain is failing and causing the scans to fail, but it is getting at least to that point. Do you have the POSReady updates installed? There is an outside chance that one of them is causing the problem. It would be good to know if anyone with them installed has Microsoft Update working properly now. Cheers, Dave.

I didn't try that then, but I've now toggled it on and off a few times and now left it on. I also tried removing all the Microsoft certificates, which stopped it working completely, not surprisingly (error 0x800B0109)! I then ran heinoganda's root certificates updater, which put some (not all) of the deleted certificates back, proving it works I suppose, which returned it to as it was before. I've also restored my original datastore.edb file, which has returned my update history I'm glad to say.

OK, I've tried the last solution, still no change I'm afraid. I did have to re-enable Microsoft Update, as you would expect. I got this screen, which i have seen before. As before, the "Check for Updates" button did nothing, but reloading the page produce the normal result. I've attached the log again. I don't know where to go from here, it is a complete mystery as to why this isn't working. As far as I'm aware nobody else has reported this problem. I've been looking to see if there is some utility which will track the certificate chain, which is presumably failing at some point, but no luck as yet. Can I say now how grateful I am for everyone's input and help with this, especially AstroSkipper of course! WindowsUpdate.log

Not yet, I'll try it tomorrow.

I checked with the HxD Hexeditor, which has a file compare function. The file in system32 and the file in the Restore_WU_XP folder\x86 folder are identical. I've just tried loading MS Update in ArcticFoxie's version of 360Chrome 13.5, which has an Internet Explorer engine function. It produced the same result, but did allow me to look at the certificate, which it said was fine.

Yes, I would be very surprised if changing the date format would make any difference, as there are people using the "non-US" format with it working fine. Changing the three services' startup mode hasn't changed anything. Only the BITS service wasn't running anyway. All three are on "Automatic" now and are starting fine. Glad you found the link interesting! PS Unchecking "Check for publisher's certificate revocation" hasn't made any difference.

I tried your certificates, and they installed (using the automatic destination determination process) into the Intermediate Certification Authorities list. I assume that's the right place for them. No difference I'm afraid. I'll have another go with ProxHTTPSProxyMII in "out of the box" condition. As you say, you "never know".

Sorry about that! Second attempt.

I haven't even got ProxHTTPSProxy installed any more. I like HTTPSProxy so much better I will carry on using it now! I did that exact test with ProxHTTPSProxy earlier on, restoring the original certificate it came with. It made no difference. Got the certificates, I'll let you know how it goes with them!

OK, I tried moving the clock to 10th March 2021 17:25:01, exactly an hour after my LastRestorePointSetTime entry. Microsoft Update then wouldn't load at all, error 0x80072F05. Rebooted, tried again, same result. Set the clock back to normal, back to the clock time error again, same after another reboot. Here are my services, have fun wading through all those!

This is what the registry entry looks like. So is that 3rd October or 10th March? Here are my services. Services.txt I went through them many years ago using the guide here (now much reformatted from when I used it!) I put them on the settings which seemed to be the most efficient. I did have to modify a few subsequently of course, but they've been as they are now for years and everything worked fine, including Microsoft Update. Please do let me have your versions of the missing certificates, one (or more) of them could be the answer of course. Although someone here a while ago said that it wasn't a good idea to use someone else's certificates on your system, I'm happy to give it a try!

Changing the DNS servers made no difference. I've looked at that registry key, and unfortunately it's a date where I can't tell whether it's in American format or the sensible format that the rest of the world uses. Do you know which it is? I'm guessing US format, but just wanted to be sure. Our Internet Options Advanced tabs are actually the same, sorry I had a "senior moment" there! Both the 'Use HTTP 1.0' options are checked. As for the missing certificates, I honestly have absolutely no idea why they're not there. I've never deleted any, so I can only assume that they have never been there! And I have absolutely no reason to think that there's anything fundamentally wrong with my IE8 installation, it works fine (with HTTPSProxy) on every other website I've tried it on that it will still display, which is not that many now of course! That's not because it's faulty of course, it's just now much too far out of date to cope with current sites! If the installation were faulty it would be malfunctioning far more I'm sure, but it's only Windows Update and Microsoft Update which have a problem as far as I can see. Even they are loading their ActiveX controls and displaying absolutely fine, it's just the scanning which is failing, which must be just a certificate problem.

I did do step 4 when I did the rest of them, just for completeness. I couldn't see any reason not to in this case. I registered the extra dll. I've now checked 'Use HTTP 1.1', but strangely 'Use HTTP 1.1 through proxy connections' isn't there. That is puzzling. I don't remember ever seeing it! I found that my 'HTTP SSL' service was disabled. I have no idea why, I can only assumed it was one of the services deemed to be unnecessary when I went through the system years ago following recommendations to disable all unnecessary running processes to speed up boot time and performance. I've put it on Automatic now. Sadly, after a reboot, nothing had changed. WindowsUpdate.log