Event 4110 CAPI2 Failed to add certificate to Third-Party Root Certification Authorities store with error: A certificate chain could not be built to a trusted root authority.

We have been noticing a lot of Event 4110 CAPI2 " Failed to add certificate to Third-Party Root Certification Authorities store with error: A certificate chain could not be built to a trusted root authority." errors in the eventlog of Windows 7 workstations lately.

After some thorough investigation, all these Windows 7 systems are in fact having issues with their Trusted Root Certificate updates.  It worked differently from Windows XP where their CA store doesn't get updated from Software Updates from Microsoft Software Updates, WSUS or SCCM Software Updates etc.  In Windows Vista or Windows 7, the update root certificates feature automatically check the list of trusted authorities on the Windows Update Website when the check is needed by a user's application.  The Event 4110 was generated when the certificate chains cannot be verified due to missing CAs.

So, in an enterprise environment where proxy servers and firewall are used, default Windows 7 (or Vista) will have problem requesting the updates of CAs.  There are a few ways to move forward.

1.  If you have one proxy server and very unlikely it will get changed, you can direct all Windows 7 systems to go through the proxy when requesting an update for CAs.  The following command will do just that.  When you restart the Cryptographic Service, you can see some actions happening.  Go to the Windows | Cryto Logs and make sure you enable the log before you do so.

To Set Proxy = netsh winhttp set proxy http://proxy:8080/
To Reset = netsh winhttp reset proxy


2.  Update the trusted root CAs by installing this file.  http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe

The rootsupd.exe can be run with a "/q" switch and it will get installed silently if you are thinking of deploying it using SCCM or something.

The problem with this option is that, you might need to do this every couple of months and also the risks of application acquiring certificates which are new and not found in this rootsupd.exe


3.  Use Group Policy to import certificates into the Trusted Root CA store.
Computer Configuration | Windows Settings | Security Settings | Public Key Policies

A lot of manual work for admins and also they will have a difficult time figuring out what trusted CA are being used by applications.


4.  Punch holes in your firewall and allow Windows 7 systems to connect directly to Microsoft for CAs.

5. Implement your own certificate domain services.  E.g.  PKI.



Articles:

Managing Trusted Root Certificates
http://technet.microsoft.com/en-us/library/cc754841.aspx#BKMK_adddomain


Certificate Support and Resulting Internet Communication in Windows Vista
http://technet.microsoft.com/en-us/library/cc749331%28WS.10%29.aspx


Dreamslayer:
http://dreamlayers.blogspot.com/2009/12/windows-7-cant-always-automatically.html