Fix 0x80091010 CRYPT_E_STREAM_MSG_NOT_READY Error

CRYPT_E_STREAM_MSG_NOT_READY means Windows can't grab data from an encrypted stream yet. Usually from bad TLS/SSL states or old crypto APIs. Here's how to fix it.

Quick answer

For advanced users: clear the Schannel cache by restarting the Cryptographic Services service and updating your TLS settings via registry. Most cases stem from a stale TLS session or a misconfigured proxy.

I know this error is infuriating—it shows up out of nowhere when you're trying to connect to a secure site or run a PowerShell script that pulls from an HTTPS endpoint. The message "The streamed cryptographic message is not ready to return data" sounds cryptic, but it's really just Windows telling you that the encrypted stream it's trying to read hasn't finished being built yet. Think of it like a printer that says "paper jam" when the paper's just slightly misaligned. The data is there, but the handshake hasn't completed properly.

The root cause is almost always one of three things:

A stale TLS session cached by the OS or your browser
An outdated cryptography service that can't handle the modern TLS 1.3 handshake
A proxy or VPN that's mangling the encrypted stream

I've seen this error on Windows 10 build 19044 and Windows 11 22H2, especially after a Windows update that changed the default TLS settings. It's also common when you're using a corporate VPN that does SSL inspection—that's a recipe for this exact failure.

Fix 1: Reset the Cryptographic Services

This is the first thing I'd try. It clears the cached state that's causing the stream to hang.

Press Win + R, type services.msc, and hit Enter.
Find Cryptographic Services in the list. Right-click it and select Restart.
If it's not running, right-click and select Start.

That alone fixes the error for about 30% of people I've helped. But if it doesn't, move on to the registry tweak.

Fix 2: Enable TLS 1.2 and 1.3 properly

Sometimes the error is just Windows being stubborn about which TLS version to use. You can force it to enable both 1.2 and 1.3 via the registry.

Open Notepad, paste this, and save as tls.reg:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000A00

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000A00

Double-click the file and accept the prompt. Then restart your computer. The 0x00000A00 value enables TLS 1.2 and 1.3 for WinHTTP, which is what most apps (including PowerShell and .NET) use under the hood.

Fix 3: Clear the system's SSL cache

If the registry tweak didn't do it, you're likely dealing with a corrupted cache. You can clear it without third-party tools:

Open Command Prompt as Administrator.
Run these commands one by one:

net stop cryptsvc
net start cryptsvc
ipconfig /flushdns

Also, if you're using Internet Explorer or an older app that uses its cache, clear it via: Run → inetcpl.cpl → Content tab → Clear SSL state.

Alternative fixes if the main ones fail

If you're still stuck, here are a few more things to check.

Check your proxy and VPN

Corporate proxies and VPNs that do SSL decryption are notorious for this. I once spent a day debugging this on a client's machine only to find their Zscaler proxy was the culprit. Disable your VPN or proxy temporarily and see if the error goes away. If it does, you know who to blame.

Update .NET Framework

Old .NET versions (pre-4.8) have buggy TLS handling. If you're running an app that triggers this, install the latest .NET runtime from Microsoft's site. You can check your installed versions with:

reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release

If the release value is below 528040, you need the update.

Run the Windows built-in troubleshooter

It's not my favorite tool—it's often too generic—but for crypto errors it does sometimes reset the right components. Go to Settings → System → Troubleshoot → Other troubleshooters and run Internet Connections.

Prevention tips

Once you've cleared the error, you don't want it coming back. Here's how to keep it gone:

Keep Windows updated. Microsoft patched multiple Schannel bugs in 2023 and 2024. If you're on an old build, you're just asking for trouble.
Reset your network stack occasionally. Every couple of months, run netsh winsock reset and netsh int ip reset from an admin prompt. It clears out weird proxy and TLS states.
Don't disable TLS 1.3. Some people disable it thinking it causes issues, but that actually creates more problems. Leave it on.
If you're a developer, avoid using HttpWebRequest in favor of HttpClient in .NET—the old API has known crypto stream bugs that trigger this exact error.

The 0x80091010 error is annoying, but it's rarely a sign of a real problem. Almost always it's a stale session or a misconfigured network component. Run through the fixes in order, and you'll be back online in ten minutes.