ASN1 0X80093202: End of Data Expected – Quick Fix

This Error Is a Pain — But It's Fixable in 5 Minutes

I've seen the 0X80093202 error pop up on everything from Windows 10 Home to a Server 2019 box running an internal PKI. When it hits, you'll see something like "ASN1 (0X80093202) - end of data expected" during Windows Update, certificate enrollment, or even just opening a secure website. The core problem is a single corrupted certificate or registry entry that Windows can't parse. Don't reinstall Windows — that's overkill.

What Actually Triggers It

Most of the time, this error comes from a botched certificate import. Maybe you tried installing a self-signed cert for a dev server, or an update (like KB5000802) left a broken certificate in the store. I've also seen it after a third-party antivirus tool quarantined a legitimate root certificate. The error message "end of data expected" tells you the ASN.1 structure is truncated — there's data missing where Windows expected more bytes. The fix is to find that broken certificate and remove it.

The Fix: Delete the Corrupted Certificate

Skip all the registry nonsense you see online. The real fix is straightforward. Here's the step-by-step that works on Windows 10 22H2, Windows 11 23H2, and Windows Server 2016 or later.

1. Press Win + R, type certlm.msc, and hit Enter. This opens the certificate manager for the local machine.
2. In the left panel, expand Trusted Root Certification Authorities.
3. Click on Certificates inside that folder.
4. Look for any certificate with a yellow warning icon, or one that has an expired date, or one you imported manually around the time the error started. If you don't see anything obvious, scroll through the list and look for certificates with a Friendly Name that's blank or says "" — those are often the bad ones.
5. Right-click the suspicious certificate and select Delete. Confirm the delete.
6. Repeat the same process under Intermediate Certification Authorities → Certificates.
7. Close certlm.msc and restart your PC.

After the restart, try the operation that failed. For Windows Update, run wuauclt /detectnow in an admin command prompt, or just check for updates normally. The error should be gone.

Why This Works

The certificate store in Windows is basically a database of X.509 certificates. Each certificate is encoded in ASN.1 DER format — a binary encoding standard. When a certificate gets corrupted (maybe a write operation interrupted, or the file was truncated), Windows can't parse it. The parser hits the end of the data before it finds the expected closing tag, and throws error 0X80093202. By removing the bad certificate, you clear the broken entry. Windows then rebuilds the store index from the remaining intact certificates.

If Deleting a Certificate Doesn't Work — Check the Registry

In rare cases, the corruption isn't in the certificate store itself but in the registry where certificate metadata lives. This happens more on Server 2016 and older. Here's the alternative fix:

1. Open regedit as administrator.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates.
3. Back up this key by right-clicking it and selecting Export.
4. Look for any subkey with a long hex string as its name (that's the certificate thumbprint). If you see one with data that looks garbled or with a value named Blob that's empty, delete that subkey.
5. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates for the same issue.
6. Restart.

This is riskier than the first method, so only do this if the certificate deletion didn't work. Also, make sure you have a backup of that registry branch before deleting anything.

Less Common Variations

Sometimes the error shows up as part of a larger chain of errors. For example, you might see 0X80093202 alongside 0x800b0109 (certificate chain validation failed) or 0x80092004 (cannot find object or property). In those cases, the fix above still applies — it's still a corrupted certificate at the root of the chain.

Another variation: the error appears in the Application event log with source Windows Error Reporting or CAPI2. You'll see something like "ASN1 bad tag value met." That's just a different way of saying the same thing — the ASN.1 parser found unexpected data. Delete the certificate and it stops.

Preventing This From Happening Again

A few habits will keep your certificate store clean:

• Never kill Windows Update mid-install. That's the number one cause of these corruptions. Let updates finish, even if they take forever.
• Be careful with self-signed certificates from dev tools. If you import one manually, always double-check that the file is complete. A partial download will land you right back here.
• Use certutil -store -user My to list certificates from a command prompt. If you see an entry that says "ERROR: Object not found" or similar, that's a sign of corruption.
• Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth once a month. They won't fix certificate corruption directly, but they'll repair system files that might trigger the same error through a different path.

I've been running a help desk for years, and this error used to take people hours to diagnose. Now you know the 5-minute fix. If it didn't work for you, check the registry — but 19 times out of 20, deleting the bad cert is all you need.