Fix CRYPT_E_INVALID_INDEX (0x80091008) Fast

You're staring at that 0x80091008 error, and it's frustrating because it just pops up out of nowhere—maybe when you try to send a signed email in Outlook, or when you plug in a smart card. Let's kill this thing.

The Quick Fix: Delete and Reimport the Certificate

Nine times out of ten, this error is a corrupt or duplicated certificate entry in your personal store. Here's how to clear it:

1. Open certmgr.msc — Press Windows + R, type certmgr.msc, and hit Enter. This opens Certificate Manager.
2. Go to Personal > Certificates — Look at the left pane. Expand "Personal," then click "Certificates." You'll see a list of certs issued to you.
3. Find the problem cert — The error usually happens with an S/MIME email signing cert or a smart card cert. Look for one that has a red X or shows "You don't have a private key." Also look for duplicates—same issuer and subject, multiple entries.
4. Export the good one first — Right-click the cert you want to keep, choose All Tasks > Export. Pick "Yes, export the private key" if it's available. If not, export without. Save as a PFX file with a password. Do this now—you don't want to lose it.
5. Delete the bad entries — Right-click any certs that show errors, duplicates, or the one you just exported, and choose Delete. Yes, delete them all if you're not sure which is bad. You'll reimport in a second.
6. Reimport your cert — Right-click in the Certificates pane, choose All Tasks > Import. Browse to your PFX file, enter the password, and let it place it in the Personal store.
7. Check the result — After import, you should see a single certificate with a small key icon on it (meaning it has the private key). Try whatever operation was failing—Outlook, smart card login, whatever.

After you do this, the error should be gone. If it's not, move to the section below.

Why This Happens

The CRYPT_E_INVALID_INDEX error means Windows is trying to look up a certificate by an index number (like array position 5), but that entry is corrupt or missing. This usually happens when:

• A certificate was partially deleted or overwritten by another app.
• You imported the same cert twice, creating two entries with the same serial number but different index positions.
• A smart card reader or middleware (like ActivClient or Gemalto) registered the cert but then the card was removed before cleanup.
• Windows Update or a patch (like KB5006670 on Windows 10) messed up the certificate store—yes, that's a real trigger.

The export/delete/reimport dance resets the index. After import, the cert gets a fresh, clean position in the store. The OS starts counting from 0 again, and the invalid index reference goes away.

Less Common Variations

Outlook 2016/2019 Specific

If you only see this error when sending signed emails in Outlook, the fix is slightly different. Outlook caches your signing cert. Clear the cache:

1. Close Outlook.
2. Open Control Panel > Mail > Show Profiles. Select your profile and click Properties.
3. Go to Email Accounts, select your account, and click Change. Look for the Security tab—if there's a signing certificate listed, remove it and re-select your cert.
4. Alternatively, delete the file %appdata%\Microsoft\Outlook\*.srs (the Send/Receive settings file) and restart Outlook.

Smart Card Readers — CAC or PIV Cards

For government or enterprise smart cards (like DoD CAC cards), the middleware might be the problem. Uninstall and reinstall the middleware (like ActivClient or Gemalto IDGo 800). After reinstall, insert the card and let it re-register the cert. If the error persists, run certutil -scinfo from an admin command prompt to see the card's cert list.

Server 2012 R2 or 2016 — IIS or SharePoint

If this error shows in an application or IIS on a server, the cert might be in the Computer account store (not the User store). Open certlm.msc instead of certmgr.msc. Look in Personal > Certificates. Same fix—export, delete, reimport.

Preventing This From Happening Again

You can't stop every Windows update from breaking your cert store, but you can make recovery painless:

• Keep a backup of your certificate as a PFX file (with private key) on a USB drive or secure cloud storage. Label it with the date and purpose (e.g., "S/MIME Cert 2025-01-15.pfx").
• Use only one certificate for email signing. Don't import multiple copies of the same cert. If you renew, revoke the old one in the store before importing the new one.
• Don't use non-Microsoft tools to manage your cert store. I've seen third-party cert managers leave orphaned index entries. Stick to certmgr.msc.
• If you're on a domain, check with your IT team about Group Policy settings that might auto-install certs. Sometimes they push the same cert twice, and that's the root cause.

That's it. The fix works on Windows 10, 11, Server 2016, 2019, and 2022. If you still see the error after all this, it's worth running a full malware scan—some crypto-mining malware messes with certificate stores. But that's a rare outlier.