Fix ASN1 bad choice value (0X8009310C) in 3 steps

What is this error and why does it show up?

You're seeing 0X8009310C — ASN1 bad choice value. I know this error is infuriating because Microsoft's error messages give you nothing useful. It usually pops up when Windows Update fails to install a security patch, or when you try to import a certificate and get a generic "the data is invalid" popup. The real trigger: a corrupted ASN.1 structure inside a system file or certificate store. ASN.1 is the format Windows uses to encode cryptographic data — think of it like a zip file for certificates. When that zip gets a bad byte, the whole thing breaks.

I've seen this hit most often on Windows 10 version 22H2 and Windows 11 23H2 after a botched update rollback. It can also happen if you've used a third-party tool to clean your registry — those tools sometimes shred certificate data accidentally.

Let's fix it. These are the three things I'd try in order. Stop when the error's gone.

Fix 1: Run the Windows Update troubleshooter (30 seconds)

Yeah, I know — the built-in troubleshooter feels like a placebo sometimes. But for this specific error, it actually works because it rebuilds the update database files that often carry corrupted ASN.1 data.

1. Press Windows + I to open Settings.
2. Go to System > Troubleshoot > Other troubleshooters (Windows 11) or Update & Security > Troubleshoot > Additional troubleshooters (Windows 10).
3. Find Windows Update and click Run.
4. Let it finish. It'll check for missing or corrupted files in C:\Windows\SoftwareDistribution and C:\Windows\System32\catroot2.

If you see "Troubleshooting completed" with a green check, try your Windows Update or certificate import again. If the error still shows up, move to Fix 2.

Fix 2: Clear update cache and reset certificate store (5 minutes)

This tripped me up the first time too. The ASN.1 error often lives in the update cache or the certificate store. Clearing both resets the corrupted data without touching your personal certificates.

Step 1: Stop update services

Open Command Prompt as Administrator. Paste these one at a time:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

You'll see each service stop. Ignore the "not running" messages — that means they're already down.

Step 2: Delete the cache folders

Run these commands to rename (not delete — safer) the cache folders:

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

Windows will recreate these fresh on next update check.

Step 3: Reset the certificate store

Still in Command Prompt, run:

certutil -store -user My

That lists your personal certificates. If you see any with a yellow warning or "ASN1 bad choice value" in the output, that certificate is the problem. Remove it with:

certutil -delstore -user My "certificate_serial_number"

But honestly — unless you know exactly which cert is broken, skip the manual removal. Instead, just restart the services and let Windows rebuild its store:

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

Now try your update or certificate import again. Still failing? Go to Fix 3.

Fix 3: DSIM and SFC repair (15+ minutes, but thorough)

This is the nuclear option — and it's the one that fixes the deepest corruption. I've seen this error survive the first two fixes only to fold after a DSIM restore. The key: run DSIM before SFC, not after. Most guides get this backward.

Step 1: Run DSIM to fix the system image

Open Command Prompt as Administrator. Run:

DISM /Online /Cleanup-Image /RestoreHealth

This scans the Windows component store for corruption. It takes 10–20 minutes depending on your drive speed. Don't interrupt it. If it fails with an error like 0x800f081f, you need a Windows installation media source. Mount an ISO or insert a USB, then run:

DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\ESD\Windows /LimitAccess

Replace C:\ESD\Windows with the path to your install.wim or install.esd. If you don't have one, you can download the Media Creation Tool from Microsoft's site — the ISO is free.

Step 2: Run SFC to fix system files

After DSIM completes successfully, run:

sfc /scannow

This checks every protected system file against the fresh image DSIM just fixed. Let it finish — it might take another 10 minutes. If it finds corrupted files and replaces them, you're golden.

Step 3: Reboot and test

Restart your PC. Try the update or certificate import again. The error should be gone.

What if none of these work?

If the error persists after Fix 3, you're looking at a deeper issue — possibly a failing hard drive with bad sectors where ASN.1 data is stored. Run chkdsk /f /r from an elevated Command Prompt to check for disk errors. That takes hours on a large drive, but it's the next logical step. And if you're on a Windows Server box (I've seen this on Server 2019 too), consider restoring from a backup before the error first appeared.

One last thing: if you got this error after installing a security update from a non-Microsoft source (like an OEM driver pack), roll back that update first. Right-click Start > Settings > Windows Update > Update history > Uninstall updates. Pick the most recent one and remove it. That alone clears the error half the time.