locked
Update for Root Certificates for Windows 7 [March 2014] (KB931125) Expired RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi All

    Today i wanted to deploy the security updates of the month march 2014 to my production environment.

    I noticed that the update "Update for Root Certificates for Windows 7 [March 2014] (KB931125)" is Expired

    Strange last week I added this update in our Acceptation environment with no problems.

    Someone knows what happend to this update , i cannot find it on the microsoft site

    regards

    Johan

    Tuesday, March 18, 2014 1:54 PM

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote

    My company opened a call at MS and I got this answer:

    The March 2014 version of KB931125 was expired and the November 2013 version of KB931125 is superseded by the March 2014 version. Configuration Manager 2007 by design will not sync from WSUS expired or superseded updates(the latter can exist in the ConfigMgr 2007 Database if it was previously sync when it wasn’t superseded, but it will get cleaned up).

    In ConfigMgr 2012 we can deploy superseded updates and for 2007 you already implemented the workaround in which the update is deployed through normal Software Distribution.

    Saturday, April 12, 2014 6:44 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi All

    Today i wanted to deploy the security updates of the month march 2014 to my production environment.

    I noticed that the update "Update for Root Certificates for Windows 7 [March 2014] (KB931125)" is Expired

    Strange last week I added this update in our Acceptation environment with no problems.

    Someone knows what happend to this update , i cannot find it on the microsoft site

    regards

    Johan

    I have the exact same problem! Any explanation would be appreciated!

    Thank you,

    Christian

    • Proposed as answer by Christian _ Tuesday, March 18, 2014 6:35 PM
    • Unproposed as answer by Christian _ Tuesday, March 18, 2014 6:35 PM
    Tuesday, March 18, 2014 2:06 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    We also noticed this issue. Anything wrong with the Root update package or wil it be replaced? I found the December one also had some similar problems?

    Our new image is now missing additional certs and we had to install the root certificate updates in a different from WU.

    For most organisations maybe more safe to install the November release. Available on update-catalog website:
    hxxp://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB931125

    Tuesday, March 18, 2014 5:18 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    realmente eles retiraram do wsus, pois havia algum tipo de problema no certificado.

    mas semana que vem lançarão um novo.

    Tuesday, March 18, 2014 5:45 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I've made some additionnal investigations and according to the KB article http://support.microsoft.com/kb/931125/en-us, the root certificates package seems no longer needed by Windows Vista and later, as required root certificates are downloaded at access on the fly.

    Nonetheless, this does still not explain why the March 2014 package is in an expired state.

    Tuesday, March 18, 2014 6:39 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Seeing the same thing, I synched my WSUS servers and now the root certificate update from November 2013 is re-deploying to the systems that had already installed the update from March 2014
    Tuesday, March 18, 2014 7:31 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Seeing exactly the same thing on my test environment.
    Wednesday, March 19, 2014 5:53 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi All

    I've read http://support.microsoft.com/kb/931125/en-us and I am a bit confused.

    Does Windows 7 update the "Root Certificates" automatically so I don't have to deploy this update with WSUS/SUP/SCCM afterall 

    I hope someone can point me to the right direction

    Regards

    Johan

    Wednesday, March 19, 2014 8:17 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Sounds like this old favourite:

    SSL/TLS communication problems after you install KB 931125

    Rolf Lidvall, Swedish Radio (Ltd)

    Wednesday, March 19, 2014 9:15 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Dutch guy

    Perhaps this will help you Check http://social.technet.microsoft.com/Forums/windowsserver/en-US/b2a9475c-559c-490a-90ea-fae2abab4a6f/update-for-root-certificates-for-windows-7-march-2014-kb931125-expired?forum=winserverwsus

    But my problem is what to do for my windows 7 clients?

    Regards and thx in advance

    Johan

    Wednesday, March 19, 2014 9:40 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Dutch guy

    Perhaps this will help you Check http://social.technet.microsoft.com/Forums/windowsserver/en-US/b2a9475c-559c-490a-90ea-fae2abab4a6f/update-for-root-certificates-for-windows-7-march-2014-kb931125-expired?forum=winserverwsus

    But my problem is what to do for my windows 7 clients?

    Regards and thx in advance

    Johan

    For now i installed Update for Root Certificates For Windows 8 [November 2013] (KB931125) 

    After installing this update, ignoring it as expired, the issue is resolved. All certs are added and no certificate issues anymore (for now). 

    So it might also fixes the Windows Store error when you already tried all options that you find using google: “We weren’t able to connect to the store. This might have happened because of a server problem or the network connection timed out. Please wait a few minutes and try again.”

    On the Windows Update catalog i found this update: http://catalog.update.microsoft.com/v7/site/search.aspx?q=kb931125 

    Maybe you could download the update for Windows 7 as well. However, it is still a workaround in my opinion. 

    Thanks!


    • Edited by Dutch guy Wednesday, March 19, 2014 10:25 AM
    Wednesday, March 19, 2014 9:59 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Any response from MS guys?


    You will most likely not get any response from MS guys here. Either open a call at Microsoft or ask the question in a WSUS related forum (as ConfigMgr just consumes the data that WSUS provides).

    Torsten Meringer | http://www.mssccmfaq.de

    Wednesday, March 19, 2014 10:25 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    > After installing this update, ignoring it as expired

    To be perfectly clear, Microsoft has not "Expired" the "November 2013" update. SCCM though might have expired the update, depending on how you have configured your "Supersedence Rules".

    Rolf Lidvall, Swedish Radio (Ltd)

    Wednesday, March 19, 2014 10:27 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    > After installing this update, ignoring it as expired

    To be perfectly clear, Microsoft has not "Expired" the "November 2013" update. SCCM though might have expired the update, depending on how you have configured your "Supersedence Rules".

    Rolf Lidvall, Swedish Radio (Ltd)

    I know, but there is no superseding update right now and therefore KB931125 on new clients won't be installed. I could unexpire the November 2013 update to get KB931125 back in the update loop.

    I used "Immediatly expire a superseded software update" and an ADR rule superseeded = no. That's what killed my deployment. 



    • Edited by Dutch guy Wednesday, March 19, 2014 5:28 PM
    Wednesday, March 19, 2014 10:52 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi All

    Luckely The November update Update for Root Certificates for Windows 7 for x64-based Systems [November 2013] (KB931125) is still applicable , but it is superseded by Update for Root Certificates for Windows 7  for x64-based Systems  [March 2014] (KB931125) and that one is expired.

    I will post this in the WSUS Forum

    Regards

    Johan

    Wednesday, March 19, 2014 12:29 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Windows Update website is offering KB931125 [november 2013] again, probably errors in KB931125 [march 2014]
    • Proposed as answer by Garth JonesMVP Saturday, March 29, 2014 2:25 PM
    Friday, March 21, 2014 9:26 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    I disagree that the Windows Update website re-offering the November 2013 KB931125 update is a resolution for ConfigMgr 2012. It might be in a 100% WSUS only infrastructure, but not in a CM12 infrastructure. Because cm12 sync'd in the March 2014, it marked the Nov 931125 as expired, due to being superseded. and then the March 2014 one was also marked expired. So as of now, my CM12 infrastructure does not see any 931125 as available to be deployed. Solutions as I see them (waiting for an official response from Microsoft): 1) instructions on how to *legitimately* un-expire an expired update for CM12 (my understanding is that any methods of doing so would be completely unsupported) or 2) preferable--Microsoft releases a newer update for KB931125, to officially replace the March 2014 version. If anyone has any instructions or better ideas; please do share.

    Standardize. Simplify. Automate.

    Monday, March 31, 2014 12:08 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I totally agree.

    A supported method for unexpiring the update is needed for both CM 2012 and CM 2007 and the KB article needs an update since it seems to be stuck on some issue with the December 2012 update.

    Monday, March 31, 2014 12:45 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    > It might be in a 100% WSUS only infrastructure, but not in a CM12 infrastructure

    Not true, because it depends on how you configure your CM 2012. If you set the "Supersedence Rules" to a high value (99 months is maximum) you will get the same functionality as in a WSUS only environment. During the time frame set CM will not expire superseded updates, only updates expired by Microsoft will be expired. 

    And this is exactly the reason why Microsoft introduced that setting in CM 2012.

    Rolf Lidvall, Swedish Radio (Ltd)


    • Edited by Rolf Lidvall Wednesday, April 2, 2014 11:16 AM Append
    Wednesday, April 2, 2014 11:13 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    So I'm trying to clean up old post, did we figure this out yet?

    http://www.enhansoft.com/

    Saturday, April 12, 2014 2:08 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    My company opened a call at MS and I got this answer:

    The March 2014 version of KB931125 was expired and the November 2013 version of KB931125 is superseded by the March 2014 version. Configuration Manager 2007 by design will not sync from WSUS expired or superseded updates(the latter can exist in the ConfigMgr 2007 Database if it was previously sync when it wasn’t superseded, but it will get cleaned up).

    In ConfigMgr 2012 we can deploy superseded updates and for 2007 you already implemented the workaround in which the update is deployed through normal Software Distribution.

    Saturday, April 12, 2014 6:44 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi All

    Luckily we added this update to our capture task sequence as separate installation (the November 2013 version)

    Now month's later I noticed this update is expired in the console , does anybody knows if Microsoft will update the KB931125 update with a new one in the future  

    Regards

    Johan

    Tuesday, December 9, 2014 8:54 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Johan,

    As far as I know KB931125 won't be updated anymore, since it was only needed for XP. There is a new automatic root cert update mechanism from Vista SP2, you can read more here and here.

    Wednesday, December 10, 2014 7:10 PM