CRYPT_E_FILERESIZED (0x80092025) – The real fix for this cert error
This error pops up when a certificate file changes size mid-operation. Usually caused by antivirus, backup software, or a flaky network share. Here's the fix.
When you see this error
You're trying to import a PFX or CER file into the Windows certificate store, or maybe your app calls CryptAcquireContext or CertOpenStore against a file. The operation starts fine, then crashes with CRYPT_E_FILERESIZED (0x80092025). The error message reads: "The Put operation cannot continue."
I've seen this most often when:
- A scheduled antivirus scan kicks in mid-import and locks the file momentarily.
- The cert file sits on a network share with slow latency and another process (backup agent, file sync) touches the same file.
- You're using a disk deduplication or compression tool that alters the file on first access.
Root cause – plain English
The Windows CryptoAPI reads the certificate file in two passes. First pass checks the header and metadata. Second pass reads the actual data. If the file's size or content changes between those passes – even by a single byte – the API panics and throws 0x80092025. It's a safety check, not a bug. The file you're pointing to isn't stable.
The fix
Skip the wild goose chase with registry tweaks or re-registering crypt32.dll. The fix is almost always about eliminating file contention.
Step 1 – Copy the file locally
Copy the PFX or CER file from the network share to a local folder like C:\Temp. Never import certs directly from a network path – I've wasted entire afternoons on that mistake.
Step 2 – Exclude the source folder from real-time AV scanning
If you're on a server with Defender or third-party AV, add an exclusion for the folder you're importing from. For Defender, use PowerShell:
Add-MpPreference -ExclusionPath "C:\Temp"If that's not possible, temporarily disable real-time protection just during the import. Re-enable it after.
Step 3 – Check for file locks
Use Handle.exe from Sysinternals or locksmith to see what's holding the file. Run this from an admin cmd prompt:
handle.exe -a "C:\Temp\your_cert.pfx"If you see an AV process or backup agent listed, kill that process or wait for its scan to finish.
Step 4 – Import using the MMC snap-in, not double-click
Double-clicking a PFX file triggers the Windows certificate import wizard, which uses the same CryptoAPI path that's failing. Instead, open the Certificates MMC snap-in (certlm.msc for local machine, certmgr.msc for current user), right-click the store, choose All Tasks -> Import. This sometimes bypasses the timing issue.
Step 5 – Use certutil.exe as a fallback
If MMC still fails, try the command-line tool:
certutil -importPFX -p YourPassword "C:\Temp\your_cert.pfx"Add the -f flag to force overwrite if needed. Certutil handles files differently than the GUI wizard and often works when the UI doesn't.
If it still fails
Check the Event Viewer under Applications and Services Logs > Microsoft > Windows > CertificateServices > Client-Lifecycle-System. Look for Event ID 1006 or 1007 – they'll tell you exactly which file operation failed and why.
Also verify the file isn't corrupted. Run certutil -hashfile your_cert.pfx SHA256 and compare the hash to what you expect. If it changes on every run, the file is being modified in real-time – that's your smoking gun.
One last thing: if you're on Windows Server 2016 or earlier, check that KB4474419 is installed. That update fixed a known race condition in crypt32.dll that could produce this exact error.
Was this solution helpful?