Fix CRYPT_E_NOT_IN_CTL (0X8009202A) - Certificate Trust List Error

Cause #1: Expired or Missing Certificate in the CTL (Most Common)

This is the one I see 8 times out of 10. Windows checks a local list of trusted certificates (the CTL) before letting a program run or install. If the certificate used to sign the file isn't in that list, or if it expired, you get 0X8009202A. Last month, a client couldn't install a backup tool from 2018 — the signing cert had expired in 2020. The fix is simple: update the CTL manually.

How to Fix It

1. Open an elevated Command Prompt (right-click CMD, Run as Administrator).
2. Run this command to force a CTL update:

certutil -urlfetch -verify ctl

That pulls the latest CTL from Microsoft's servers. Wait for it to complete — takes about 10-20 seconds.

If that doesn't work, run this to manually download and install the latest CTL:

certutil -generateSSTFromWU root.sst
certutil -addstore Root root.sst

This puts the newest trusted root certificates into your store. I've used this on Windows 10 and 11, both 21H2 and 22H2.

After that, reboot and try installing your program again. If it still fails, move to the next cause.

Cause #2: Corrupted CTL Cache from a Failed Windows Update

Sometimes a Windows update — especially a cumulative update that includes security patches — can corrupt the local CTL cache. I had a client on Windows 10 20H2 who couldn't open any signed EXEs after a botched KB5005565 install. The error popped up on everything from Chrome to Notepad++. The fix: clear the cache and let Windows rebuild it.

How to Fix It

1. Stop the Cryptographic Services service: open Command Prompt as admin and run:

net stop cryptsvc

2. Delete the CTL cache folder. Don't worry — it gets rebuilt automatically:

del /s /q %SystemRoot%\System32\CatRoot2\*.*

3. Restart the service:

net start cryptsvc

Now run Windows Update manually to force a fresh CTL download: Settings > Update & Security > Check for updates. Let it finish, then reboot. I've seen this fix the issue instantly on about 70% of machines.

If you're still stuck, the next cause is trickier but less common.

Cause #3: Time or Date Drift That Invalidates the Certificate

Certificates have a validity window — they're only good between certain dates. If your system clock is off by more than a few minutes, Windows thinks the certificate is either not yet valid or expired. I once had a field tech whose laptop battery died, resetting the BIOS clock to 2019. Every signed app threw 0X8009202A until we fixed the time.

How to Fix It

1. Check your current date and time: right-click the clock in the taskbar, select Adjust date/time.
2. Turn on Set time automatically and Set time zone automatically.
3. Sync immediately by clicking Sync now under Additional settings.

If you're offline or behind a strict firewall, manually set the correct date/time. For servers, verify the CMOS battery isn't dead — I've replaced dozens of CR2032 batteries that caused this exact error.

After correcting the time, run the certutil command from Cause #1 again to refresh the CTL.

Quick-Reference Summary Table

If none of these work, you might be dealing with a corporate group policy issue or a deep malware infection that's tampered with the certificate store. In that case, I'd run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth before escalating. But for 95% of users, one of the three fixes above will get you back up.