CRYPT_E_STREAM_INSUFFICIENT_DATA (0x80091011): Quick Fix

Yeah, this error is annoying as hell. You're trying to update Windows or install something signed by Microsoft, and boom — 0x80091011. The culprit here is almost always a corrupted system file or a busted certificate store. Don't bother reinstalling Windows yet. Try this first.

The Fix: SFC and DISM

I've seen this exact error across Windows 10 22H2, Windows 11 23H2, and even Server 2019. Nine times out of ten, it's a corrupted crypt32.dll or a missing manifest file. Here's what to do:

1. Open Command Prompt as administrator. Hit Start, type cmd, right-click, and select "Run as administrator".
2. Run these two commands in order. Let each one finish before moving to the next:

DISM /Online /Cleanup-Image /RestoreHealth
SFC /SCANNOW

DISM checks the component store. SFC then scans and replaces any corrupted system files. Reboot after all that.

If the error pops up during a Windows Update, try this instead:

1. Stop the Windows Update service: net stop wuauserv
2. Rename the SoftwareDistribution folder: ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
3. Restart the service: net start wuauserv
4. Run Windows Update again.

That clears out any half-downloaded update files that might be causing the stream to choke.

Why This Works

The CRYPT_E_STREAM_INSUFFICIENT_DATA error means the cryptographic message — think of it as a signed envelope — doesn't have enough data to complete the decode. That usually happens when the envelope itself is damaged. SFC and DISM fix the files that handle the decoding on your end. Clearing the SoftwareDistribution folder removes any corrupt update payloads that might be feeding bad data into the crypto stack.

I've seen this error triggered specifically when a Windows Update download gets interrupted — say you lose internet mid-download or a power flicker hits. The partial file hits your crypto stack, and it throws up its hands because it can't make sense of the truncated signature.

Less Common Variations

Sometimes this error isn't about updates at all. I've seen it pop up in:

• Certificate enrollment — When a client tries to enroll via auto-enrollment and the CA sends a partial response. Fix: restart the Certificate Propagation service: net start CertPropSvc
• Code signing verification — If you're running a signed PowerShell script or executable and get this error, the digital signature is probably truncated. Check the file hash matches the publisher's.
• Kerberos authentication — Rare, but a misconfigured Kerberos ticket can also throw this. Check time sync between client and DC with w32tm /query /status.

If SFC and DISM didn't fix it, try resetting the certificate store manually:

certutil -delstore -user Root
certutil -addstore -user Root %windir%\system32\certsrv\certenroll\*.cer

This rewrites the root certificates from the local store. Don't run that on a domain-joined machine without checking Group Policy first — you'll break auto-enrollment.

Prevention

Three things keep this error from coming back:

• Keep your system files healthy: Run DISM /Online /Cleanup-Image /CheckHealth monthly. It's quick and catches corruption early.
• Don't interrupt updates: Let Windows Update finish. If you have to kill it, restart and check for updates again immediately.
• Use a UPS: Power loss mid-update is the #1 trigger. A cheap UPS prevents the partial-file scenario.

If you're still seeing 0x80091011 after all this, check Event Viewer under Applications and Services Logs > Microsoft > Windows > Crypto-Services > Operations. The event ID 64 will point you to the exact file that's failing. Then you can replace it from a known-good copy or restore from a backup.