Often when using a software product to work with the Federal Treasury Continent AP users encounter the error " Root certificate not found". There may be several reasons for the appearance of this error, in this article we will list the main ones and find out what to do in such cases and how to remove the error. Please note that the information is relevant at the time of writing the article, if the listed methods do not help you cope on your own with a problem - you can always contact the technical support department of the Treasury or the developers of the Continent AP program.
Reasons for the error "Root certificate not found" in Continent AP
1. Root certificates not installed certification center (CA) of the Federal Treasury. Usually, the OFC employees write them to a flash drive along with the user's personal certificate. Here you need to check their presence in trusted root certification authorities. To do this, you need to enter along the path: Start - Control Panel - Internet Options- Tab " Content" - Paragraph " Certificates" - Paragraph " Trusted Root Certification Authorities", lower the slider to them and see which root certificates are installed with the Russian designation. If everything is done correctly, you should see something like this:
If you do not have these certificates in the list, you need to download and install them, the procedure is described below. You can also check for installed certificates in the system by pressing the Win keys (the key in the bottom row of the keyboard with the Windows icon) + R and in the window that appears, type certmgr.msc, press Enter.
2. CA root certificates were mistaken or intentional removed. Again - download and install certificates.
3. Root certificates have expired. A very rare mistake, CUs are issued for a long period - from 5 to 10 years, but other versions are sometimes released. The troubleshooting in this case is the same - download and install fresh root certificates.
4. Problem with CryptoPro. Often updated versions of the Crypto Pro program do not work correctly with Treasury programs and certificates. We have already written about this, for example,. The solution is to reinstall Crypto Pro to a newer or, conversely, an older version.
5. Limited user rights. Continent AP error "No root certificate found" was seen in version 10 of Windows. The solution is to give the user full rights.
6. Incorrect operation of the program Continent AP. The solution is the complete removal and installation of the current version of the Continent AP program according to the Guide available on the official website.
Download Link for Treasury Root Certificates
You can download the valid root certificates of the Treasury certification center from the official website at the link: roskazna.ru/gis/udostoveryayushhij-centr/kornevye-sertifikaty/For correct operation, you need to download and install both proposed certificate files:
1. Certificate of the Head Certification Center of the Ministry of Telecom and Mass Communications,
2. Certificate of the Certification Center of the Federal Treasury.
Their release dates may vary, as a rule, they are issued for several years.
How to install
Before installing the CA root certificate, you must make sure that you have the Crypto-Pro program installed and its license is active. Right-click on the downloaded certificate and select Install Certificate from the menu. Next, select the storage location - User or Local Computer. We recommend choosing the second option. Click the Next button. Select Place certificates in the following store, click Browse, click Trusted Root Certification Authorities, click OK, Next, and Finish. An installation warning sign will appear:
If you did everything correctly, a message will appear stating that the import was completed successfully. The same procedure must be done with the installation of the second root certificate. You can download the archive with the current Root Certificates at the time of this writing by
Not so long ago, budgetary organizations, namely the administrations of village councils, began to contact me with a request to help them set up the Electronic Budget system. This is another project of our, give_them_all_health, government, as part of the services of the Electronic Government of the Russian Federation project. Grandmothers and aunts in villages and village councils with old computers and very slow internet. Join our VK group! Under repair! Smart Workshop!
They are obliged, on an equal basis with everyone, to be able to install this according to the instructions and use it. Otherwise, terms. Someone is waiting for fulfillment, here are the workers of rural administrations and reaching out to those who can help them with this. Of course, they don't have a full-time programmer. Well, okay, all this is poetry. Let's get down to business. People have a disk in their hands, apparently with distributions, and a desire for this kind of Electronic budget to work for them.
On the disk, in principle, everything is neatly laid out and it was not a problem to install the whole thing according to the instructions. By the way, there is also an instruction on the Roskazny website itself. There were no particular problems following the instructions to install a set of programs, certificates, etc. As a result, after the last reboot and prescribing a proxy to the browser (the mozilla was chosen). Attempt to enter the site http://lk.budget.gov.ru/ was not successful. After selecting the user certificate, the site began to swear: The root certificate was not found. Although I personally installed it, adding it to the trusted root certificates according to the instructions. After sitting for a while and flipping through the instructions again, I discovered such an interesting moment that I think other people may encounter.
And I stubbornly displayed in the form:
As you can see, the Local Computer storage is not here. This is where the dog rummaged. Well, apparently they know better there, and we will go around, adding where necessary. To do this, press Start and in line Find programs and services we type: certmgr.msc.
The system certificate management console opens. Let's go to Trusted Root Certification Authorities -> local computer-> Right click on Certificates -> All tasks -> Import.
The Certificate Import Wizard opens. Click Next -> Browse -> and specify the path to the root certificate file. By the way, if you suddenly didn’t download it according to the instructions, you can download it from the Roskazny website by selecting the qualified one.
If you have opened certmgr.mscand you don’t have a branch there either local computer. Do not get upset, there is still a way, we press Start and in line Find programs and services we type: mmc. If you are a user of win 7 and above, I advise you to run mmc as administrator. How to do this I wrote. In the console that opens, go to the menu File -> Add remove snap. In the list of available snap-ins, look for Certificates. We sequentially add the snap-in for the current user and the local computer.
And voila, going to http://lk.budget.gov.ru/ making sure everything works. The error with the root certificate should at least disappear. But the thing is that everything will work… I can't promise. In general, I advise you to go every time through http://budget.gov.ru/ Then Entrance in the upper right corner, and on the large button Entering the personal account of the Electronic Budget system. Well, do not be afraid of mistakes, etc. The system is currently working in test mode, and it does not enter it the first time. We poke and suffer 🙂
Join our VK group!
One of the most common errors in the AWP "Electronic Budget" program is an error that occurs when connecting to the server, which has an index number of 434. It is quite simple to solve it, in most cases only 2 actions help:
1. TLS Continent build update to the current version. For example, version number 920 was unstable and often the connection ended with a 434 "Destination server unavailable" error. The current version can be downloaded from the site securitycode.ru.
2. Checking if the address is entered correctly personal account of the user of the "Electronic budget" program in the TLS Continent, as well as the port number (8080). The string must not contain spaces or any other characters either at the beginning or at the end of the string. The correct address would be: lk.budget.gov.ru(as in the photo). If you are setting up a proxy server through a browser, it must be configured accordingly. If you are not working through a proxy server, the checkbox in the TLS settings should not be checked. More on that below.
Error 434 "The destination server is unavailable." How to remove?
If the above two options for solving problems did not help you (updating the assembly and correctly spelling the address of your personal account), then the problem most likely lies in the incorrect installation of the root certificates of the certification authority or the proxy settings in the browser and it is also solvable.- Regarding certificates- some users, when installing the program incorrectly, put the root certificates of the CA and TLS in the Registry, while according to the instructions correctly - in the Local Computer. In this case, moving the certificates will help.
If you choose to set up a proxy server in the browser - it must be enabled in the correct way. You must specify the type of proxy - HTTP and check the box that the proxy server will be used for all protocols. Firefox browser configuration example below.
A new version of HandyCache has been released.
The changes made in this version are mainly related to fixing problems and bugs.
I put the updated dll libraries libeay32.dll and ssleay32.dll compiled by me into the archive of the previous version. These libraries work when the SSL Handling option is enabled. As I found out, one of them required the presence of the msvcp120.dll library when loading it. The absence of this library on the computer led to the fact that when HandyCache was started with the SSL processing option enabled, the message Port xxxx is already busy appeared. This time, I compiled the dlls mentioned so that the additional dlls are no longer needed.
I am sometimes asked: what version of Windows does HandyCache require? If you do not use the SSL Handling option, you can use Windows 7 or 10. If you use the SSL Handling option, then it is better to use Windows 10. If you use Windows 7, HandyCache cannot ensure the SSL Handling option works when accessing some sites. When using Windows 10, there are much fewer such sites. If HandyCache cannot perform SSL processing when working with a certain site, then it automatically disables this option for this site and in the Monitor, in the Rules column, the message Stop SSL decryption for this host+useragent is displayed.
The full list of changes can be found below.
To install version RC4 1.0.0.885, unpack the archive over the existing version, replacing the existing files. New lists of rules will be created automatically when HandyCache starts, only if there are no current lists (files *.lst, *.lso and *.lsb).
If HandyCache has not yet been installed on your computer, then simply copy the contents of the archive to an empty folder and run the exe file.
Loading...