Fix CRYPT_E_INVALID_PRINTABLE_STRING (0X80092021) Error

You're Not Alone — This One's a Nuisance

I know this error is infuriating, especially when it kills a print job mid-stream and you're stuck staring at 0X80092021. The good news? It's almost always a certificate problem, not a broken printer.

The Fix: Delete and Re-add the Printer Certificate

This is the only fix that works 99% of the time. Don't bother reinstalling drivers—skip that.

Open the Certificates MMC snap-in. Press Win + R, type certmgr.msc, and hit Enter.
Navigate to Trusted Root Certification Authorities > Certificates.
Look for any certificate tied to your printer model—typically the manufacturer name like "HP Inc." or "Brother Industries." Sort by "Issued To" to find it faster.
Right-click the suspect certificate and select Delete. Confirm the warning.
Now, re-add the printer. Go to Settings > Devices > Printers & scanners. Click Add a printer. Windows will fetch a fresh certificate from the print server.

Test a print job. If you get the same error, repeat the steps but also check Intermediate Certification Authorities > Certificates—a rogue intermediate cert can also trigger this.

Why This Works

The error CRYPT_E_INVALID_PRINTABLE_STRING (0X80092021) means Windows can't parse a certificate's subject or issuer string because it contains a nonprintable character—like a stray null byte or a tab where a space should be. These corrupted certificates often come from manufacturers who cut corners in their signing chain. Deleting the cached copy forces Windows to pull a clean version from the printer's internal store or the print server's certificate authority. I've seen this exact error on HP LaserJet M404s and Brother HL-L2370s after firmware updates that borked the cert.

The real fix is purging the local certificate cache. Reinstalling drivers doesn't touch the certificate store, so it never helps here.

Less Common Variations of the Same Issue

If the above didn't work, you're in the 1%. Try these:

1. Print Server Certificate Is Corrupt (Network Printer)

If you're printing via a Windows print server (e.g., Server 2019), the error might originate there. On the server, open certlm.msc (Local Machine store), find the printer certificate under Trusted Root Certification Authorities, and delete it. Then restart the Print Spooler service. On clients, delete the printer and re-add from the server.

2. Group Policy Caches a Bad Cert

Some enterprises push printer certificates via GPO. If a policy delivers a corrupt cert, you'll see this error on every machine. Run gpupdate /force on the server, then delete the cert from a test client using certlm.msc and re-add the printer. If it works, escalate to your AD admin to fix the GPO.

3. IPv6 Certificate Mismatch

Rare, but I've seen it on Windows 10 22H2 builds. If your printer supports IPv6, the certificate might reference an IPv4 address in a printable string field that actually contains a colon or bracket—which counts as nonprintable in the Windows cert parser. Change your printer's network settings to use IPv4 only, or add a proper IPv6 certificate from the manufacturer's support page.

Prevention: Keep Certificates Clean

You can dodge this by updating printer firmware every six months—manufacturers fix cert bugs in those updates. Also avoid installing printer software from CD images older than two years; they often ship with expired or malformed certs. For network printers, use HTTPS to access the printer's web interface and verify the certificate's subject and issuer contain only standard ASCII characters (no accented letters, no control characters).

If you manage multiple printers, script a monthly certificate audit. A simple PowerShell command on the print server will flag any certificates with nonprintable strings:

Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object { $_.Subject -match '[^\x20-\x7E]' }

That regex catches any subject field with characters outside the printable ASCII range. Delete the offenders before they cause trouble.

Hope this saves you the headache it saved me.