Surface RT/Surface 2: Update KB4516067 revokes certificates

[German]A brief information for owners of a Surface RT (or all Surface models with 32-bit Windows 8.1 RT): With update KB4516067 Microsoft has accidentally revoked the certificates so that Internet Explorer can no longer be used.

Update KB4516067 declares certificates invalid

MVP colleague Barb Bowman has pointed in a tweet what happened with update KB4516067 for Windows 8.1 RT.

update kb4516067 breaks IE11 on @Surface RT/Surface 2. need to uninstall and block Windows Updates to recover. Testing seems to be reaching new lows..

— Barb Bowman (@barbbowman) September 12, 2019

ddd

Susan Bradley weist bei askwoody.com ebenfalls auf das Problem hin. Wer das Update KB4516067 installiert, kann anschließend den Internet Explorer 11 nicht mehr für https-Seiten verwenden. Denn das Update zieht alle Zertifikate zurück – wenn der IE 11 ein Zertifikat validieren möchte, ist dieses dann ungültig. Das Ganze wurde im Microsoft Answers-Forum in diesem Thead thematisiert.

Latest Windows update pushed 9/10/19 causes Internet explorer to not run on my surface 2.

Latest Windows update causes Internet explorer to not run on my surface 2. Update was pushed 0n 9/10/19.

Error: The certificate has been revoked by its certification authority. See DefaultBrowser_NopublisherId in event viewer.

I saw that the update pushed a new version of I.E.

Uninstalling the 4 updates fixes the problem. Reinstalling the updates and the problem comes back. Must be a problem with the update. Can't install a different browser on Windows RT. Update basically turns the surface 2 into a boat anchor. Had to make registry hack to shut off windows update. Why can't we get help from Microsoft when they break stuff?

The user installed the update KB4516067 issued on September 10, 2019. After that the Internet Explorer threw him an error message of the kind:

The certificate was revoked by his certification authority. See DefaultBrowser_NopublisherId in the Event Viewer.

This affects Surface RT as well as Surface 3 users, as Barb Bowman states in the thread. If we now postulate that Microsoft does not intend to withdraw the Surfaces from use, a bug has slipped into the update. After publishing the German article I received a mail from German blog reader Matthias D. (thank you), who confirmed the issue.

Hello, Günter,

is rather marginal, since Windows 8.1 RT (on Surface 2) is not quite as common, but still does its job for rudimentary tasks.

Since the patchday in September, after the installation of KB4516067 [September 10, 2019-KB4516067 (Monthly Rollup)], the Internet Explorer no longer works (see screenshot); the app-based IE closes without comment.

The problem does not occur on systems with Windows 8.1 x64. Solution: Uninstall KB4516067.

Remedy: Uninstall update and block installation

The remedy is simple under Windows 8 RT or Windows 8.1 RT. You uninstall updates KB4516067 and block it for further installation. This should make Internet Explorer 11 surf again. If this does not help, only a refresh (reset) of the surface with update blockade remains. Barb Bowman also asks the rhetorical question:

.@WindowsUpdate kb4516067 is breaking IE on Surface RT and Surface 2. Trending in Answers forum. How do you test these things? When will there be a fix? These customers are not comfortable uninstalling updates and disabling WU.

— Barb Bowman (@barbbowman) September 12, 2019

Concerning the question I was asked (several times within my German blog), how we can block the updates: Windows RT doesn't have an update control like Windows 8.x. But you can use the registry key described within this blog post.