Known issue for security update 3136000 for the .NET Framework 4.6.1/4.6 and security update 3135996 for the .NET Framework 4.5.2 in Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows Server 2008 R2 SP1

View products that this article applies to.

Introduction

Customers who operate in environments that are disconnected from the Internet or who have not deployed the most up-to-date Microsoft certificates from the Trusted Root Program may encounter update installation failures. This behavior occurs because of recent changes to Microsoft Windows Enforcement of Authenticode Code Signing and Timestamping.

Note This known issue affects only Windows Server 2008 R2 Service Pack 1 (SP1), Windows Server 2008 Service Pack (SP2), Windows 7 Service Pack 1 (SP1), and Windows Vista Service Pack 2 (SP2). It does not affect any newer Windows operating systems.

↑ Back to the top

Symptoms

When you try to install update 3135996 or 3136000 , the installation process fails. Additionally, you receive the following error message:

A certificate chain could not be built to a trusted root authority.

↑ Back to the top

Cause

This issue occurs when you operate in an environment that's disconnected from the Internet or that has a firewall that blocks content from the following URL:

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en

↑ Back to the top

Resolution

To resolve this known issue, download and install the latest Microsoft certificates by using one of the following methods:

Method 1: System administrators and customers must make sure that their firewall lets the system connect to the following URL:

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en

After a client system can connect to this URL, the required certificates will be available. For more information, see the Configure trusted roots and disallowed certificates topic at TechNet.
Method 2: System administrators and customers who decide not to allow Internet connections, or who do not open their firewalls to http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en, can download and install update 2813430, and then manage their certificates individually by following the instructions in KB 2813430.

For more information, see the Configure trusted roots and disallowed certificates topic at TechNet.
Method 3: System administrators and customers can refer to the Add a trusted root certification authority to a Group Policy object topic at TechNet. For Windows Server 2008 R2, see the Use policy to distribute certificates topic.

To directly download the Microsoft Certificate Authority 2011 certificate, go to Microsoft Root Certificate Authority 2011.

Thumbprint: 8f 43 28 8a d2 72 f3 10 3b 6f b1 42 84 85 ea 30 14 c0 bc fe
Method 4: System administrators and customers can use the UI provided by the certmgr.msc MMC snap-in to add certificates to the trusted root store. Right-click the Trusted Root Certification Authorities option to display the All Tasks options. The Import option should be used to display the Certificate Import Wizard, which will help you install the root certificate.

To directly download the Microsoft Certificate Authority 2011 certificate, go to Microsoft Root Certificate Authority 2011.

Thumbprint: 8f 43 28 8a d2 72 f3 10 3b 6f b1 42 84 85 ea 30 14 c0 bc fe
Method 5: System administrators and customers can use the certmgr.exe utility to add a certificate by using the following command line:

certmgr /c /add TrustedCert.cer /s root

For more information, see the Certmgr.exe (Certificate Manager Tool) topic at MSDN.

To directly download the Microsoft Certificate Authority 2011 certificate, go to Microsoft Root Certificate Authority 2011.

Thumbprint: 8f 43 28 8a d2 72 f3 10 3b 6f b1 42 84 85 ea 30 14 c0 bc fe

↑ Back to the top

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

↑ Back to the top

Applies to:

↑ Back to the top

Keywords: atdownload, kbbug, kbexpertiseinter, kbfix, kblangall, kbsecurity, kbsecbulletin, kbsecreview, kb, kbsecvulnerability, kbmustloc

↑ Back to the top

Article Info

Article ID	:	3149737
Revision	:	3
Created on	:	4/18/2017
Published on	:	4/18/2017
Exists online	:	False
Views	:	536

Microsoft KB Archive Search

Known issue for security update 3136000 for the .NET Framework 4.6.1/4.6 and security update 3135996 for the .NET Framework 4.5.2 in Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows Server 2008 R2 SP1

Introduction

Symptoms

Cause

Resolution

Status

Applies to: