Fix ASN1 0X80093100 Certificate Encode/Decode Errors

If you're staring at 0X80093100 (that's CRYPT_E_ASN1_ERROR — ASN.1 encoding/decoding failure), you've got a malformed certificate. I've seen this a hundred times. The fix is usually dead simple, but people waste hours messing with permissions or CSPs. Don't. Here's what actually works.

Cause #1: Bad Base64 in the Certificate File

The most common trigger is a certificate file that's supposed to be base64-encoded but got mangled. You see this when someone copies a certificate from an email or a web form, and line breaks get stripped or spaces get inserted. The ASN.1 parser chokes on the garbage character.

The Fix: Re-encode the file cleanly

Grab your original base64 string and make sure it looks like this:

-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIUVXm... (all one long line here)
-----END CERTIFICATE-----

No extra spaces, no weirdness, no headers like Subject: inside. If you're pulling from an email, save it to notepad first, then copy it again. Then try importing with certutil.exe:

certutil -addstore My C:\path\to\yourcert.cer

If it still throws 0X80093100, the base64 itself is corrupted. Re-export it from the source (like your CA) or re-download it. Don't waste time trying to repair it by hand — that never ends well.

Cause #2: Wrong Encoding Type (DER vs Base64)

Sometimes the file is actually a DER binary file, but you're trying to import it as base64, or vice versa. The ASN.1 decoder expects one format and gets the other. This happens when you download a .cer file from a website and it's actually in DER format, but your script assumes base64.

The Fix: Convert or force the correct encoding

First, check the file's first few bytes. If you see -----BEGIN it's base64. If you see random binary (usually starting with 30 in hex), it's DER.

To convert DER to base64, use OpenSSL (or certutil if you're on Windows):

openssl x509 -inform der -in cert.der -outform pem -out cert.pem

To go the other way (base64 to DER):

openssl x509 -in cert.pem -outform der -out cert.der

On Windows, you can also use certutil:

certutil -decode cert.cer cert.der

That will decode the base64 and give you a clean DER file. Then re-import the correctly encoded version.

Cause #3: Truncated or Corrupted Certificate Data

Less common but happens — the file got truncated during transfer or disk write. The ASN.1 parser gets a partial structure and throws 0X80093100 because it can't find the end-of-contents marker. This also happens when you export a certificate with a private key and only copy the public part, or when the cert was copy-pasted from a PDF (yep, seen that).

The Fix: Re-export the certificate fresh

Don't try to patch the file. Go back to the source — your CA, your PKI, wherever it came from — and export a clean copy. If it's a user certificate, get it from certmgr.msc → Certificates → Current User, right-click the cert, All Tasks → Export, and choose Base-64 encoded X.509 (.cer).

If you're pulling from a remote server, use openssl s_client to grab the server's cert directly:

openssl s_client -connect example.com:443 -showcerts /dev/null | openssl x509 -outform pem > server.pem

That gives you a pristine copy. Then import that.

Quick Reference Table

One last thing — if you're dealing with code (like C# or PowerShell), make sure you're reading the file as bytes, not as a string with encoding transforms. That's another way to mangle the data. But 9 times out of 10, the fix is just getting a clean certificate file. Start there, and you'll have it sorted in five minutes.