CRYPT_E_OSS_ERROR (0X80093000) Fix – Certificate Encode/Decode Problem

Quick answer for advanced users: Re-export the certificate in Base64 format using a working machine, then import on the broken one. If that's not possible, run certutil -repairstore my or delete and reimport the cert.

I've seen this error pop up mostly in two places: when a small business admin tries to install a new SSL certificate on an internal server, or after a Windows update nukes the certificate store. The core problem is that Windows' cryptographic library (crypt32.dll) can't decode the ASN.1 structure inside the certificate file. Could be a corrupted .cer file, a mismatch between binary and Base64 encoding, or the store got corrupted. Had a client last month whose entire website went down because they downloaded a cert from GoDaddy in the wrong format. This fix saved their afternoon.

Step 1 – Identify the certificate file format

Open the .cer or .crt file in Notepad. If you see -----BEGIN CERTIFICATE----- at the top, it's Base64-encoded. If it looks like scrambled binary characters, it's DER-encoded. Most apps need Base64. If you're seeing DER, convert it first.

Step 2 – Re-export the certificate (if you still have access to the original source)

On the machine where the certificate was originally created or issued:

1. Open certlm.msc (Local Machine) or certmgr.msc (Current User).
2. Find the certificate under Personal or Trusted Root Certification Authorities.
3. Right-click → All Tasks → Export.
4. Choose Base-64 encoded X.509 (.CER). This is crucial. Do not pick DER.
5. Export the private key if required (mark it exportable).

Step 3 – Import the re-exported certificate on the broken machine

On the machine throwing the error:

1. Open certlm.msc.
2. Right-click Personal → All Tasks → Import.
3. Browse to the Base64 .cer file you just exported. Import it.

If the error disappears, you're done. If not, move to the next step.

Step 4 – Use certutil to repair the store (when re-export isn't an option)

Sometimes you don't have the original source. The certificate is already in the store but corrupted. Run this command as Administrator:

certutil -repairstore my

This rebuilds the Personal store. If the certificate was in a different store (like Root), replace my with root or CA. Wait for it to complete – usually takes under 30 seconds. Reboot and try your application again.

Step 5 – Check for Windows updates and reinstall KB patches

I've seen this error after specific Windows 10 and Server 2019 cumulative updates. Check Settings → Update & Security → View update history. If you see a recent update (like KB5009543 or KB5012170), uninstall it temporarily to see if it resolves the error. If it does, reinstall it later – the next patch usually fixes the regression.

Alternative fix – Delete and re-import the certificate manually

If the above fails, don't waste time. Delete the certificate from the store entirely and import a fresh copy:

1. Open certlm.msc.
2. Locate the certificate causing the error. Look for a yellow triangle warning icon.
3. Right-click → Delete.
4. Get a fresh copy of the certificate (preferably Base64) from your CA or admin.
5. Import it again via All Tasks → Import.

Why this happens – real scenarios

This error is not random. I've seen it when:

• A user drags a .cer file from email directly into the certificate store without right-clicking install.
• An application like Outlook tries to use a corrupted S/MIME certificate after an update.
• A VPN client (SonicWall or Cisco AnyConnect) imports a certificate in wrong encoding.

Prevention tip

Always export certificates in Base64 format, not DER. When downloading from a CA like DigiCert or Let's Encrypt, choose the PEM option (it's the same as Base64). Keep a backup of your certificate store once a month using this command:

certutil -exportPFX -p YourPassword my cert_backup.pfx

Store that PFX file somewhere safe. Then when this error hits again – and it will – you can restore the whole store in under a minute.