ASN1 (0X80093102) unexpected end of data — root cause fix

You hit 0X80093102, and it's maddening

One second you're importing a certificate or installing an update, the next you're staring at "ASN1 unexpected end of data" and wondering what you broke. You didn't break anything—the error means the system tried to parse a data structure that ended too soon. The fix is straightforward once you know where the bad data lives.

The fix: nuke the corrupted certificate and reimport

Step 1 — Open the local machine certificate store

1. Hit Win + R, type certlm.msc, press Enter.
2. If you're not admin, certmgr.msc opens the user store instead. You need certlm.msc for machine-level certs—that's where Windows Update and system services look.

Step 2 — Find the offending certificate

1. Expand Trusted Root Certification Authorities → Certificates.
2. Sort by Issued By or Friendly Name. Look for anything with a red X, an expired date, or a name that doesn't look right—like a self-signed test cert you imported months ago and forgot about.
3. Right-click the suspect cert → Delete. Confirm the prompt.

Step 3 — Check Intermediate Certification Authorities too

1. Repeat the same drill under Intermediate Certification Authorities → Certificates.
2. Corrupted intermediate certs trigger the same error. If you see a certificate with a blank or garbled Valid from date, that's your culprit.

Step 4 — Reimport the certificate cleanly

1. Get a fresh copy of the certificate file. If it came from an email or a website, download it again—do not use the original file you already have.
2. Right-click the .cer or .p7b file → Install Certificate.
3. Choose Local Machine → Place all certificates in the following store → Browse → Trusted Root Certification Authorities → OK → Finish.

Why this works

The core issue is that Windows stores certificates as ASN.1-encoded binary blobs. When a certificate file is truncated—say it downloaded only 80% of the bytes, or a disk write got interrupted—the ASN.1 parser hits a tag that says "expect 1024 more bytes" but reaches the end of the data after 500. The parser throws 0X80093102 because the structure is incomplete.

Deleting the old cert from the store removes the damaged blob entirely. A fresh import gives Windows a complete, valid ASN.1 tree. The reason step 3 works is that intermediate certificates are part of the chain—if one of them is truncated, the whole chain verification fails and the error surfaces even if the root cert is fine.

Less common variations of the same problem

Corrupt PKCS#7 (.p7b) file

.p7b files bundle multiple certificates. If one cert inside the bundle is truncated, you'll get 0X80093102 when trying to install it. The fix is to extract the individual certs using the command line and import them one at a time:

certutil -split -p7 filename.p7b

This dumps each cert as a separate .cer file. Then import only the ones that are valid—skip any that fail certutil -verify.

Windows Update failing with 0X80093102

This happens when a root certificate used to sign update metadata is corrupted. Run this to rebuild the root cert store from scratch:

certutil -generateSSTFromWU roots.sst
certutil -addstore -f Root roots.sst

The first command downloads Microsoft's current root list. The second overwrites your store with clean copies. This is a nuclear option—it wipes all manual additions—but it kills the error dead.

ASP.NET or IIS hitting the error on SSL binding

If you're using a self-signed certificate generated with New-SelfSignedCertificate in PowerShell, the error often means the certificate's private key is missing or the file export included only the public part. Re-generate with the -KeyExportPolicy Exportable flag and export as PFX, not CER.

How to stop this happening again

• Never copy certificate files over unstable network shares or USB drives without verifying the checksum. Use certutil -hashfile to compare hashes before importing.
• If you're exporting certificates from a remote machine, use certutil -exportPFX with the -p password option—not the Windows GUI wizard, which sometimes truncates data on network paths.
• Keep your system root certificates updated automatically via Windows Update. If you've manually added a root, set a calendar reminder to check its expiration every 3 months.
• For developers: when generating test certificates in code, always wrap the ASN.1 encoding in a try-catch and log the byte length before writing. The error is nearly always a write that didn't complete.

Bottom line: 0X80093102 is Windows telling you a data structure broke in half. Don't chase registry keys or reinstall .NET—just delete the bad cert and bring in a clean one. That's the root cause, and that's the fix.