Fix CERT_E_MALFORMED 0X800B0108 certificate error

Quick answer

Run certutil -repairstore my "" from an admin command prompt. If that doesn't stick, manually delete and re-import the root certificates from a trusted source.

Why this happens

You're seeing 0X800B0108 because Windows found a certificate that's missing fields or has a corrupted structure. This isn't an expired certificate — it's one that was never formed right in the first place. I see this most often after a failed Windows Update, a bad third-party installer that mangled the root store, or when a corporate endpoint security tool (like a web filter or antivirus) injects its own certificate and does it wrong.

The real trigger is almost always something that edited the CertLocalMachine or CertCurrentUser stores mid-process — a shutdown during an update, a malware cleanup that yanked too many certs, or a VPN client that installed a broken intermediate.

Fix steps (main solution)

Let's start with the cleanest path. You'll need admin rights.

Open an elevated Command Prompt. Click Start, type cmd, right-click Command Prompt, choose Run as administrator. Accept the UAC prompt.
Check the current certificate store health. Run this command:
```
certutil -verifystore my
```
You'll see a list of certificates. Look for any with CERT_E_MALFORMED or CERT_E_UNTRUSTEDROOT in the status column. Take note of the serial number or thumbprint if you spot one.
Repair the entire personal store. Run:
```
certutil -repairstore my ""
```
The double quotes with nothing inside tell it to scan every entry. After pressing Enter, you should see a line like certutil: -repairstore command completed successfully. If you see errors, note them but continue.
Rebuild the root and intermediate stores. These are the common culprits. Run both:
```
certutil -repairstore root ""
certutil -repairstore CA ""
```
Each should finish with the same success message.
Re-register the Cryptography API. This reconnects the certificate services. Run:
```
regsvr32 /s cryptdlg.dll
regsvr32 /s certmgr.dll
regsvr32 /s wintrust.dll
```
You won't see a pop-up — the /s flag suppresses it. That's fine.
Restart the system. This ensures all services load the repaired stores. After reboot, test the app that was throwing the error.

Alternative fixes if the main one fails

Sometimes the store itself is too far gone. Try these in order:

Run System File Checker.
```
sfc /scannow
```
Wait for it to finish. It'll replace corrupted system files, including certificate DLLs. Takes about 15 minutes on a modern system. Afterward, reboot and test.
Run DISM to fix the component store. If SFC finds errors it can't fix, use:
```
DISM /Online /Cleanup-Image /RestoreHealth
```
This needs internet access. Let it run to completion — could take 30 minutes. Reboot after.
Manually delete the corrupted certificate. Open certmgr.msc (Run as administrator). Expand Trusted Root Certification Authorities > Certificates. Look for certificates with a red X or a warning icon. Right-click and delete them. Then download the correct root from the Microsoft Update Catalog or the issuing CA's website. Import it using the Certificates Import Wizard — place it in the Trusted Root Certification Authorities store.

Prevention tip

Stop letting third-party apps install their own root certificates. That's the number one cause. When a VPN, antivirus, or web filter asks to install a certificate, think hard. If you must allow it, check the certificate's thumbprint against the vendor's official documentation first. Also, set Windows Update to install automatically — Microsoft regularly pushes root store updates through Windows Update, and missing those leaves you vulnerable to exactly this kind of corruption.