Fix ASN1 0X80093104 Value Too Large Error

1. Bad Windows Update (Most Common)

I see this error most often after a Windows update fails halfway through. The update tries to install a new certificate but the old one is left in a broken state. The error code 0X80093104 pops up when the system reads that partial certificate and sees a field that's way too big — like a size value that says 5000 bytes for something that should only be 10.

Had a client last month whose entire print queue died because of this. The update broke the root certificate for the print server. Every print job threw this error. Took 20 minutes to fix.

How to fix it

1. Run Windows Update Troubleshooter. Go to Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Update. Let it run.
2. If that doesn't clear it, manually reset the update cache. Open Command Prompt as admin and run:
   net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver
3. Restart and check for updates again. This clears the broken certificate cache.

2. Corrupted Certificate in Store

Sometimes the error shows up when you try to install a new certificate or run a signed script. The ASN1 parser trips on a certificate file that has a malformed field — like a serial number or validity period that's out of range. I've seen this with SSL certificates from cheap providers that didn't follow the spec exactly.

Fix steps

1. Open mmc.exe (Microsoft Management Console).
2. File > Add/Remove Snap-in > Certificates > Computer account > Local computer.
3. Navigate to Trusted Root Certification Authorities > Certificates.
4. Look for any certificate with a red X or that says "invalid" or "corrupted" in the status column. If you see one, right-click and delete it.
5. Also check Intermediate Certification Authorities > Certificates.
6. Restart the computer. The system should re-fetch the right certificates from Windows Update.

If you can't find the bad certificate, use certlm.msc (for local machine) and filter by "Not valid after" date. Delete expired ones from 2023 or earlier. Had a network where an expired 2020 root cert was causing this error on every remote desktop connection.

3. Corrupted System Files (Bonus)

This is less common but happens when a virus or bad driver corrupts the crypto API files. The error appears for any certificate operation — installing software, browsing HTTPS sites, even opening some apps.

How to check and fix

1. Run SFC (System File Checker). Open Command Prompt as admin and type:
   sfc /scannow
2. If SFC finds errors but can't fix them, run DISM:
   DISM /Online /Cleanup-Image /RestoreHealth
3. Restart and try the operation again.
4. If still broken, do a repair install of Windows using the Media Creation Tool. Choose "Keep personal files and apps".

Quick Reference Table

Most people I help fix this with the first method. Try it before anything else. If you're still stuck after trying all three, you probably have a deeper issue like a failing hard drive or malware that keeps re-corrupting the certificates. Run a full antivirus scan and check your disk health with CrystalDiskInfo.

Real talk: I've seen this error on Windows 10 and 11, both 64-bit. Rarely on Server editions unless someone manually imported a bad certificate. If you're on an enterprise domain, check with your IT team before deleting certificates — some are pushed by Group Policy.