Unofficial Root Certificates 2007 Update

[erpdude8]

To MDGx, the_guy and everyone else concerned about the new MS Root Certificates Update revised in 2007 and later:

I've recently downloaded the newest release of the Root Certificates Update here:

http://download.windowsupdate.com/msdownlo...en/rootsupd.exe

However, this one was revised Jan. 15, 2007 and no longer works under Windows 9x/ME/NT4

systems. Running this new version of ROOTSUPD.EXE displays "the ROOTSUPD.EXE file is

expecting a newer version of Windows" message when used on a Win9x/ME/NT4 computer.

Versions of ROOTSUPD.EXE revised in 2007 and beyond are only compatible with Windows

XP, Server 2003 and Vista systems. I'm not sure if this new ROOTSUPD.EXE patch will

work under Windows 2000. The Root Certificates Update is now listed on the V6 Windows

Update site when I went there on my WinXP SP2 + IE7 machine.

Therefore I've decided to create an unofficial Root Certificates update (I call it the

Unofficial Root Certificates 2007 Update) that will work under Windows 9x, ME, 2000 and

NT4 systems as long as IE 5.x/6.x is installed. I have sent the unofficial root certificates

2007 patch to MDGx and he'll post it as soon as possible. It'll be called RTCERTUP.EXE.

Edited February 2, 2007 by erpdude8

[erpdude8]

the_guy, if you need the RTCERTUP.EXE patch I made, email me and I will send it to you ASAP.

[the_guy]

I found a link for the update for older OS's (2000 and previous).

9x/ME/NT4/2000: http://www.download.windowsupdate.com/msdo...658a4f6d589.exe

XP/2003/Vista: http://www.download.windowsupdate.com/msdo...f144720f759.exe

the_guy

[erpdude8]

I found a link for the update for older OS's (2000 and previous).

9x/ME/NT4/2000: http://www.download.windowsupdate.com/msdo...658a4f6d589.exe

XP/2003/Vista: http://www.download.windowsupdate.com/msdo...f144720f759.exe

the_guy

unfortunately, the 9x/ME/NT4/2000 link you mentioned contains older Root Certificates.

the XP/2003/Vista link contains newer Root Certificates

Here's the new one I found in the WindowsUpdate.log file on my WinXP machine:

http://www.download.windowsupdate.com/msdo...64cff75229e.exe

I think this one may work under Win9x/ME/2000/NT4. I'll have to test this one to make sure it works.

Edited February 3, 2007 by erpdude8

[RJARRRPCGP]

"the ROOTSUPD.EXE file is

expecting a newer version of Windows" message when used on a Win9x/ME/NT4 computer.

I likely was the first one to notice this! Also, when I checked the properties of it, it said "Vista"!

Thus even Windows XP may not be supported anymore, despite it wasn't EOL'ed!

[MDGx]

* Microsoft Internet Explorer 5.xx/6.xx Root Certificates Update (RCU) for Windows 98/NT4 SP6a/2000/ME/XP/2003/Vista (English):

http://download.windowsupdate.com/msdownlo...rtf/en/4702.htm

- RCU for Windows XP/2003/Vista [275 KB]:

http://download.windowsupdate.com/msdownlo...en/rootsupd.exe

- Unofficial RCU for Windows 98/NT4 SP6a/2000/ME [235 KB]:

http://www.mdgx.com/files/RTCERTUP.EXE

Thanks erpdude8 for unofficial RTCERTUP .

HTH

[Rick Chauvin]

thanks for the roots update

[PROBLEMCHYLD]

This update don't prompt to install.Thanks erpdude8

[MDGx]

Update

¯¯¯¯¯¯

Official RCU found on WU [Windows Update] works with all 98/98SE/ME/NT4/2000 [and all newer] OSes.

Therefore unofficial RTCERTUP.EXE is not needed anymore:

* Microsoft Internet Explorer 5/6/7 Root Certificates Update (RCU) for Windows 98/NT4 SP6a/2000/ME/XP/2003/Vista:

http://download.windowsupdate.com/msdownlo...rtf/en/4702.htm

RCU [251 KB, English]:

http://download.windowsupdate.com/msdownlo...64cff75229e.exe

HTH

[cdgoldin]

Gentlemen, I’m totally confused by this thread.

http://download.windowsupdate.com/msdownlo...en/rootsupd.exe (dated Monday, January 15, 2007 15:38:48) will NOT work on Windows 98, as mentioned by erpdude8 in post #1. It displays a message stating this, and instructs the user to update his/her operating system. Microsoft has verified that they will NOT be updating Windows 98 root certificates in future as “support” for that product has ended.

http://www.download.windowsupdate.com/msdo...658a4f6d589.exe, referenced by the_guy in Post #3, is dated Thursday, September 07, 2006 14:11:31. Although it does not display any error messages when run under Windows 98, it doesn’t display any message indicating it has successfully installed (or done anything). Nor does running it solve the root certificates problem for Windows 98.

http://www.download.windowsupdate.com/msdo...f144720f759.exe, referenced by the_guy in Post #3, is dated Thursday, December 14, 2006 15:43:04. Although it does not display any error messages when run under Windows 98, it doesn’t display any message indicating it has successfully installed (or done anything). Nor does running it solve the root certificates problem for Windows 98.

http://www.download.windowsupdate.com/msdo...64cff75229e.exe, referenced in by erpdude8 in Post #4, is dated Thursday, January 18, 2007 11:30:15. Although it does not display any error messages when run under Windows 98, it doesn’t display any message indicating it has successfully installed (or done anything). Nor does running it solve the root certificates problem for Windows 98.

In post #6, MDGx provides the following link for “Microsoft Internet Explorer 5.xx/6.xx Root Certificates Update (RCU) for Windows 98/NT4 SP6a/2000/ME/XP/2003/Vista (English):

http://download.windowsupdate.com/msdownlo...rtf/en/4702.htm

However this is simply a link to a description of an update, not a downloadable file!

In post #6, MDGx also provides the following link: Unofficial RCU for Windows 98/NT4 SP6a/2000/ME [235 KB]: http://www.mdgx.com/files/RTCERTUP.EXE.

However, this link returns and “Not Found” error (404).

In post #9, MDGx states: Official RCU found on WU [Windows Update] works with all 98/98SE/ME/NT4/2000 [and all newer] OSes. Therefore unofficial RTCERTUP.EXE is not needed anymore, and references the following two links:

http://download.windowsupdate.com/msdownlo...rtf/en/4702.htm, which is a description of the update, not a downloadable file,

and

http://download.windowsupdate.com/msdownlo...64cff75229e.exe, which is the same do nothing (for Windows 98) update mentioned above.

Thus, none of these downloads provides a solution to the Windows 98 root certificates problem that has existed for several months.

[MDGx]

Gentlemen, I’m totally confused by this thread.

http://download.windowsupdate.com/msdownlo...en/rootsupd.exe (dated Monday, January 15, 2007 15:38:48) will NOT work on Windows 98, as mentioned by erpdude8 in post #1. It displays a message stating this, and instructs the user to update his/her operating system. Microsoft has verified that they will NOT be updating Windows 98 root certificates in future as “support” for that product has ended.

http://www.download.windowsupdate.com/msdo...658a4f6d589.exe, referenced by the_guy in Post #3, is dated Thursday, September 07, 2006 14:11:31. Although it does not display any error messages when run under Windows 98, it doesn’t display any message indicating it has successfully installed (or done anything). Nor does running it solve the root certificates problem for Windows 98.

http://www.download.windowsupdate.com/msdo...f144720f759.exe, referenced by the_guy in Post #3, is dated Thursday, December 14, 2006 15:43:04. Although it does not display any error messages when run under Windows 98, it doesn’t display any message indicating it has successfully installed (or done anything). Nor does running it solve the root certificates problem for Windows 98.

http://www.download.windowsupdate.com/msdo...64cff75229e.exe, referenced in by erpdude8 in Post #4, is dated Thursday, January 18, 2007 11:30:15. Although it does not display any error messages when run under Windows 98, it doesn’t display any message indicating it has successfully installed (or done anything). Nor does running it solve the root certificates problem for Windows 98.

In post #6, MDGx provides the following link for “Microsoft Internet Explorer 5.xx/6.xx Root Certificates Update (RCU) for Windows 98/NT4 SP6a/2000/ME/XP/2003/Vista (English):

http://download.windowsupdate.com/msdownlo...rtf/en/4702.htm

However this is simply a link to a description of an update, not a downloadable file!

In post #6, MDGx also provides the following link: Unofficial RCU for Windows 98/NT4 SP6a/2000/ME [235 KB]: http://www.mdgx.com/files/RTCERTUP.EXE.

However, this link returns and “Not Found” error (404).

In post #9, MDGx states: Official RCU found on WU [Windows Update] works with all 98/98SE/ME/NT4/2000 [and all newer] OSes. Therefore unofficial RTCERTUP.EXE is not needed anymore, and references the following two links:

http://download.windowsupdate.com/msdownlo...rtf/en/4702.htm, which is a description of the update, not a downloadable file,

and

http://download.windowsupdate.com/msdownlo...64cff75229e.exe, which is the same do nothing (for Windows 98) update mentioned above.

Thus, none of these downloads provides a solution to the Windows 98 root certificates problem that has existed for several months.

Clarifications:

1. Just because there is no warning/dialog box/prompt/etc, that doesn't mean the installers don't work.

M$ designed all these installer executables to install completely unattended [require no intervention/reboot/anything from the user].

Except for this file:

http://download.windowsupdate.com/msdownlo...en/rootsupd.exe

which works only with NTx OSes [XP, 2003 + Vista], all others work with 9x OSes [98, 98 SE + ME].

That is because rootsupd.exe above is built using a newer version of iexpress, which works only with XP, 2003 + Vista.

To learn about iexpress.exe, wextract.exe + makecab.exe and how M$ builds installers [you can do this too, BTW ], please see these links + downloads at my web page:

http://www.mdgx.com/add.htm#IEA

2. The files within these Root Certificates installers [respectively the *.SST files] are almost identical [except the authroots.sst file which has a slightly different file size, but otherwise installs identical certificates on all OSes], and they install the most recent Roots Certificates, except for this file:

http://download.windowsupdate.com/msdownlo...658a4f6d589.exe

which installs older certificates [outdated].

3. These 2 files:

http://download.windowsupdate.com/msdownlo...f144720f759.exe

and:

http://download.windowsupdate.com/msdownlo...64cff75229e.exe

have different file sizes [because of the different file size of the authroots.sst file contained inside them], but they both install identical [most recent] certificates on all 9x + NTx OSes [see list above].

4. This unofficial file:

http://www.mdgx.com/files/RTCERTUP.EXE

which I have later on removed from my site [and which now redirects to this web page: http://www.mdgx.com/ietoy.htm#RCF instead of returning a 404 HTTP error ], is not necessary anymore, because erpdude8 discovered the official M$ file that works the same, and which installs the most recent Certificates on all OSes [see above]:

http://download.windowsupdate.com/msdownlo...64cff75229e.exe

That's why my web page:

http://www.mdgx.com/ietoy.htm#RCF

now links to the only official M$ file you need.

HTH [Hope This Helps]

[cdgoldin]

The reason I say the installer doesn't appear to work with Windows 98 is that, in addition to the absence of any display indicating it has executed successfully, I am still receiving warnings of invalid certificates at a growing number of sites.

Is there any way to determine if the installer has actually executed, e.g. by the presence of certain files and/or registry entries? The ONLY *.SST file present on my Windows 98 computer is "C:\WIN98\All Users\DRMdrmv2.sst" dated Tuesday, November 21, 2006 08:50:30!

In late November of 2006, the following (root certificate) problem was encountered while attempting to logon to gmail accounts from Windows 98 using IE6 SP1 (It does not occur with Windows 2000 using IE6 or Firefox). In recent months, the identical problem has been encountered on a growing number of sites:

I am presented with the following warning: "Security Alert...The name on the certificate is invalid or does not match the name of the site".

This does not occur with Windows 2000! The (gmail) certificate is dated 9/1/2006-2008. Although others have reported the problem, none of the FAQs nor "user forums" have a solution for the problem. One suggested that there is no root certificate for the issuer (Thawte Premium Server CA), and this may indeed be the problem. There was a root certificates update for Windows 2000 on 10/24/2006. There has not been a root certificates update for Windows 98 since 1/11/2006!

The problem remains after downloading and running (?) rootsupd_a153023b66d29034420aa227ccc2164cff75229e.exe

[MDGx]

The reason I say the installer doesn't appear to work with Windows 98 is that, in addition to the absence of any display indicating it has executed successfully, I am still receiving warnings of invalid certificates at a growing number of sites.

Is there any way to determine if the installer has actually executed, e.g. by the presence of certain files and/or registry entries? The ONLY *.SST file present on my Windows 98 computer is "C:\WIN98\All Users\DRMdrmv2.sst" dated Tuesday, November 21, 2006 08:50:30!

In late November of 2006, the following (root certificate) problem was encountered while attempting to logon to gmail accounts from Windows 98 using IE6 SP1 (It does not occur with Windows 2000 using IE6 or Firefox). In recent months, the identical problem has been encountered on a growing number of sites:

I am presented with the following warning: "Security Alert...The name on the certificate is invalid or does not match the name of the site".

This does not occur with Windows 2000! The (gmail) certificate is dated 9/1/2006-2008. Although others have reported the problem, none of the FAQs nor "user forums" have a solution for the problem. One suggested that there is no root certificate for the issuer (Thawte Premium Server CA), and this may indeed be the problem. There was a root certificates update for Windows 2000 on 10/24/2006. There has not been a root certificates update for Windows 98 since 1/11/2006!

The problem remains after downloading and running (?) rootsupd_a153023b66d29034420aa227ccc2164cff75229e.exe

I don't think such [but I may be wrong] problems/errors generated at different web sites are related to the root certificates installed by these updates [most recent one should have newest valid certificates].

To determine if root certificates have been installed on Windows 9x:

1. Make sure you are running Windows using the registry files from before applying any of these updates [restore from REG backups if necesary (if any)].

2. Start button -> Run box -> type regedit -> press Enter or click OK -> highlight "My Computer" main tree -> click on the "Registry" menu item -> select "Export Registry File..." -> type REGOLD.REG (or whatever filename you wish, just keep the .REG extension) in the "File name" field -> browse to the drive and folder where you want REGOLD.REG to reside -> click the Save button.

3. Run this root certificates update [i recommend this one as being most recent]:

http://download.windowsupdate.com/msdownlo...64cff75229e.exe

4. Start button -> Run box -> type regedit -> press Enter or click OK -> highlight "My Computer" main tree -> click on the "Registry" menu item -> select "Export Registry File..." -> type REGNEW.REG (or whatever filename you wish, just keep the .REG extension) in the "File name" field -> browse to the drive and folder where you want REGNEW.REG to reside -> click the Save button.

5. Compare the 2 REG files side by side [to see all differences in your registry after installing root certificates] using a graphical windiff type of tool [the one from M$ Win98 Resource Kit does just fine = free], to use it you must download the 3 files below:

ftp://ftp.microsoft.com/services/technet/...FILE/GUTILS.DLL

ftp://ftp.microsoft.com/services/technet/...ILE/WINDIFF.EXE

ftp://ftp.microsoft.com/services/technet/...ILE/WINDIFF.HLP

See all 3 files above:

ftp://ftp.microsoft.com/services/technet/...98/reskit/FILE/

or by running FC.EXE command line DOS tool [which should reside into %windir%\COMMAND , where %windir% = usually C:\WINDOWS] from a DOS box/session/window (example):

FC REGOLD.REG REGNEW.REG

FC help screen is obtained by running:

FC /?

Compares two files or sets of files and displays the differences between

them.

FC [/A][/C] [/L] [/LBn] [/N] [/T] [/W] [/nnnn] [drive1:][path1]filename1

[drive2:][path2]filename2

FC /B [drive1:][path1]filename1 [drive2:][path2]filename2

/A Displays only first and last lines for each set of differences.

/B Performs a binary comparison.

/C Disregards the case of letters.

/L Compares files as ASCII text.

/LBn Sets the maximum consecutive mismatches to the specified number of

lines.

/N Displays the line numbers on an ASCII comparison.

/T Does not expand tabs to spaces.

/W Compresses white space (tabs and spaces) for comparison.

/nnnn Specifies the number of consecutive lines that must match after a

mismatch.

None of these root certs updates install any files, they just modify the registry, deleting old/obsolete/outdated certs and installing new ones.

Therefore registry comparison side by side if the the only way to determine such changes.

That is except if using RegMon [free]:

http://www.microsoft.com/technet/sysintern...ies/regmon.mspx

which monitors in the background all registry changes, and displays them in real time [formerly by SysInternals, now belongs to M$].

I don't think Gmail [Google mail] errors are related to root certs, I just tried Gmail using Win98 SE + MS IE 6.0 SP1 with all updates installed [+ the previous root certs update from October 2006, not newest one from February 2007], and had no errors.

Actually the previous root certs update [that one installed properly on all Win32 OSes] was released sometimes in October 2006 if memory serves.

HTH

[cdgoldin]

>"I don't think such ... problems/errors generated at different web sites are related to the root certificates"

If not, how can we explain the fact that the problem appeared on ALL our Windows 98 SE systems running IE6 SP1 (with all the available updates), but not on Windows 2000 SP4 running IE6 SP1, about the same time a root certificate update was issued for Windows 2000, but not Windows 98?

Or that all the certificates causing difficulties were recently issued by Thawte (AFTER the last Windows 98 root certificate update)?

Or that the problem is appearing in new certificates every few weeks now?

If the problem isn't the root certificate, then my next guess would be that the format of the "security" certificates has been changed, and (no longer "supported") Windows 98 cannot recognize the newer format certificates.

>"To determine if root certificates have been installed on Windows 9x...."

I was hoping there was a date or perhaps a new entry in the "CertificationAuthorities" registry key. Exporting the registry before and after an update (which has already theoretically run) in order to do

a comparison is a bit cumbersome. Additionally, even if the comparison indicates something has changed in the registry, it doesn't indicate it has changed correctly, if we don't know what modifications to expect.

>"I don't think Gmail [Google mail] errors are related to root certs, I just tried Gmail using Win98 SE + MS IE 6.0 SP1 with all updates installed [+ the previous root certs update from October 2006, not newest one from February 2007], and had no errors."

Hmmm. Yet, I encounter the same difficulty logging on to Gmail on multiple Windows 98 IE6 SP1 systems. So, if it's not the root certificate, and it's not a change in certificate format, what else could it be?

>"Actually the previous root certs update [that one installed properly on all Win32 OSes] was released sometimes in October 2006 if memory serves."

The last "Root Certificates Update" available for Windows 98 via "Windows Update" was Tuesday, January 11, 2005.

[MDGx]

cdgoldin:

> "If not, how can we explain the fact that the problem appeared on ALL our Windows 98 SE systems running IE6 SP1 (with all the available updates), but not on Windows 2000 SP4 running IE6 SP1, about the same time a root certificate update was issued for Windows 2000, but not Windows 98?"

New findings: please read this post:

http://www.msfn.org/board/?s=&showtopi...st&p=627497

> "Or that all the certificates causing difficulties were recently issued by Thawte (AFTER the last Windows 98 root certificate update)? Or that the problem is appearing in new certificates every few weeks now? If the problem isn't the root certificate, then my next guess would be that the format of the "security" certificates has been changed, and (no longer "supported") Windows 98 cannot recognize the newer format certificates."

You could be right, I have no way of checking.

> "I was hoping there was a date or perhaps a new entry in the "CertificationAuthorities" registry key. Exporting the registry before and after an update (which has already theoretically run) in order to do a comparison is a bit cumbersome. Additionally, even if the comparison indicates something has changed in the registry, it doesn't indicate it has changed correctly, if we don't know what modifications to expect."

Comparing saved REG files from before + after installing root certs gives the most accurate result I know of. If you know of a better way, please post here.

> "Hmmm. Yet, I encounter the same difficulty logging on to Gmail on multiple Windows 98 IE6 SP1 systems. So, if it's not the root certificate, and it's not a change in certificate format, what else could it be?"

I have no idea. Maybe contacting Thwate/Verisign and/or M$ and asking about these errors?

> "The last "Root Certificates Update" available for Windows 98 via "Windows Update" was Tuesday, January 11, 2005."

I was talking about the 1 released on WU (Windows Update) at this URL:

http://download.windowsupdate.com/msdownlo...en/rootsupd.exe

and which (at that time) I had posted on my site (newest 1 before they posted the February 2007 update):

http://www.mdgx.com/ietoy.htm#RCF

HTH