Fix CRYPT_E_PENDING_CLOSE 0x8009200F: CryptoAPI Shutdown Hang

Cause 1: An app is still holding a certificate handle open

The most common trigger is an application that loads a certificate but doesn't release it properly before you shut down. This shows up when you try to close a program, sign out, or restart Windows. You'll see the error pop up as a dialog box titled "CryptoAPI" or in the Event Viewer under Application logs with source "Microsoft-Windows-CAPI2".

Typical culprits are older VPN clients (like Cisco AnyConnect 4.x), email clients (Outlook 2016 with S/MIME), or any software that uses smart card logon. The fix here is simple: close all apps that touch certificates, then try again.

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Look under the Processes tab for anything named crypto, certutil, or your VPN/email client. Right-click and select End task.
3. If you can't find them, go to the Details tab and sort by name. Look for lsass.exe — that's normal, don't kill it. Instead, end processes like rasman.exe (Remote Access Connection Manager) or svchost.exe that host the CryptSvc service.
4. After you've closed those, restart your computer normally. The error should be gone.

If you're not sure which app it is, the quick test is to log off and log back on without restarting. If the error doesn't appear, it's definitely a per-session handle leak. Then you can narrow it down by closing one app at a time and logging off each time.

Cause 2: Corrupted CryptoAPI cache or missing system files

When closing apps doesn't stop the error, the next suspect is a corrupted local certificate cache. This happens after a failed Windows update, a disk full error, or a sudden power loss while the crypto service was writing data. The error appears when you try to open a certificate store or enumerate certificates — not just at shutdown.

Here's the fix that clears the cache without touching your actual certificates:

1. Press Win+R, type services.msc, and hit Enter.
2. Find Cryptographic Services. Right-click it and select Stop. Wait for the service to stop — it usually takes about 5 seconds.
3. Now open File Explorer and go to this folder:
   C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
4. You'll see a bunch of files with long hex names. Delete all of them. Yes, it's safe. These are just temporary key handles, not your actual private keys.
5. Go back to services.msc, right-click Cryptographic Services, and select Start.
6. Restart your PC. After the reboot, the error should be gone.

If that folder doesn't exist or is empty, run the System File Checker. Open Command Prompt as Administrator and type:

sfc /scannow

This takes about 15 minutes. It will replace any corrupted system files that might be causing the crypto service to misbehave. After it finishes, reboot.

Cause 3: A buggy driver or third-party service interferes with crypto operations

The least common cause, but one I've seen on Dell laptops and some Lenovo ThinkPads, is a driver that hooks into the Windows crypto stack. Fingerprint readers, TPM drivers, and some older Wi-Fi drivers do this. The error shows up randomly when you're not doing anything crypto-related — just browsing or opening files.

To pin it down:

1. Press Win+R, type msinfo32, and hit Enter.
2. Go to Software Environment > System Drivers. Look for anything with "crypto", "tpm", or "fingerprint" in the name. Note the driver file paths.
3. Check if those drivers have known issues. For example, the Synaptics WBDI driver (for fingerprint readers) has had multiple updates to fix crypto handle leaks.
4. Update the driver from the manufacturer's site, not Windows Update. For Dell, use Dell Command Update. For Lenovo, use System Update.
5. If updating doesn't help, uninstall the driver, reboot, and see if the error disappears. If it does, you've found the culprit.

Also, check for third-party antivirus that injects into processes. Some versions of Bitdefender and Kaspersky have been known to interfere with CryptoAPI. Temporarily disable the antivirus for 30 minutes and test. If the error stops, add an exclusion for crypt32.dll and cryptsvc.dll in your antivirus settings.

Quick-reference summary table

If you've tried all three and the error persists, the last resort is a repair install of Windows. That's overkill for most people, but I've seen it fix a deeply corrupted certificate store that no amount of cache clearing could touch.