Fix CRYPT_E_NOT_DECRYPTED (0x8009100A) in 2 Steps

You're staring at 0x8009100A and it's confusing because you were sure you already decrypted. I get it — this error pops up when you're trying to open something that's still encrypted, but it's not always obvious why.

The Real Fix: Decrypt Before Reading

Here's the blunt truth: that message, file, or email is still wrapped in encryption. The key is sitting in your certificate store, but nothing has told Windows to actually decrypt it yet. In 90% of cases, you just need to open or apply the decryption explicitly.

1. If it's an email in Outlook:
   • Open the message. Don't just preview it in the reading pane.
   • Double-click the email so it opens in its own window.
   • Look for a yellow bar at the top that says "Click here to read this message."
   • Click that bar. After you click, the message text should appear. The error should go away.
   • Close the message, then open it again. If the text shows, you're good. If the error comes back, your certificate is missing — jump to Step 2 below.
2. If it's a file (like a .p7m or signed document):
   • Right-click the file and select Properties.
   • Go to the Digital Signatures tab. You might not see this if the file isn't signed — in that case, skip to the next fix.
   • Click View Certificate, then Install Certificate.
   • When the Certificate Import Wizard opens, pick Local Machine (yes, you need admin rights for this). Click Next.
   • Choose Place all certificates in the following store, click Browse, select Trusted Root Certification Authorities, and hit OK.
   • Click Finish. After the import completes, you should see a success message. Now try opening the file again.

After following either of these, the error should disappear. If it doesn't, the certificate chain is broken or the wrong key is in play.

Why This Error Happens

Windows uses a system called CryptoAPI to handle encryption. When you get 0x8009100A, it's saying: "I have an encrypted blob here, but nobody has called the decrypt function yet." The function CryptDecryptMessage is literally waiting to be called, and the system hasn't processed the private key against the encrypted data.

Think of it like a locked safe. The safe is sitting there, the key is nearby, but nobody turned the key in the lock. Opening the email or clicking that yellow bar is the equivalent of turning the key. If the key isn't in your keychain (certificate store), you get this error instead of the safe opening.

Common triggers:

• Opening an S/MIME encrypted email in Outlook without clicking the decryption bar.
• Trying to read a PKCS#7 encrypted file (.p7m) without the sender's public certificate imported.
• Writing custom software that calls CryptDecryptMessage but doesn't pass the right CRYPT_DECRYPT_MESSAGE_PARA structure.

Less Common Variations

Sometimes the standard fix doesn't cut it. Here are the edge cases I've seen in 15 years of help desk work:

Missing Private Key

You have the certificate, but the private key portion is missing. This happens when you install a certificate without marking it as exportable, or when you move your profile to a new computer without migrating the private key. Check in certmgr.msc under Personal > Certificates. If the certificate icon has a little key on it, you're fine. If it's just a ribbon with no key, you don't have the private key. Re-import from a .pfx file that includes the private key.

Wrong Certificate Store

The decryption context might be looking in the wrong store. For Outlook, it checks the Current User personal store. For a system service or IIS, it checks the Local Machine personal store. If you installed the certificate for the wrong user, move it using the Certificates snap-in in MMC.

Corrupted Message

Rare, but possible. If the encrypted data was truncated or corrupted during transfer, the decryption function sees an incomplete structure and throws this error before even trying to decrypt. Try getting a fresh copy from the sender. If you're the sender, re-encrypt the message.

Outdated CryptoAPI

On really old versions of Windows — like Windows 7 without any service packs — the CryptoAPI might lack support for newer encryption algorithms like AES-256-GCM. Update Windows fully. If you can't update, switch the sender to use 3DES or RSA with SHA-1 (not recommended for security, but it works).

Prevention for Next Time

This error doesn't have to come back. Here's what to do now to avoid it:

• Export your certificate with the private key after you import it. Go to certmgr.msc, right-click your certificate, choose Export, select Yes, export the private key, set a strong password, and save the .pfx file. Store it somewhere safe (like a USB drive in a locked drawer).
• Always click the decryption bar in Outlook before trying to forward or save an encrypted message. If you don't, the forwarded copy stays encrypted — and the recipient won't be able to open it either.
• Keep your certificate chain intact. If you get a new computer, import your .pfx file onto it before opening any old encrypted emails. The private key must be present before Outlook tries to decrypt.
• Update Windows regularly. Microsoft patches CryptoAPI bugs and algorithm support. Run Windows Update at least once a month.

That's the whole playbook for 0x8009100A. One click, one import, and you're back in business.