Fix DIGSIG_E_DECODE (0x800B0006) ASN Decoding Error

The 30-Second Fix: Check the File Integrity

This error pops up when Windows tries to verify a digital signature but the ASN (Abstract Syntax Notation) structure inside is corrupt or incomplete. I've seen it most with old driver installers downloaded from third-party sites—one client's printer driver from 2018 had this exact error because the signature was truncated during download.

First, re-download the file from the official source. No joke—half the time, that's all it takes. If you got a .cab, .cat, or .exe, grab it fresh. Then right-click the file, go to Properties > Digital Signatures, and check if any signature shows as valid. If it's missing or says 'error', you've got a bad file.

Still broken? Move to the next fix.

The 5-Minute Fix: Registry Tweak for Certificate Verification

Sometimes Windows' certificate verification gets finicky with older ASN encoding. I've had this happen on Windows 10 22H2 with certain legacy device drivers. Here's a safe registry change that loosens the verification without killing security entirely.

1. Open Regedit as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
3. If you don't see a key named Crypto, right-click > New > Key and name it Crypto.
4. Inside Crypto, create a DWORD (32-bit) named IgnoreASNDecodeErrors.
5. Set its value to 1.
6. Close Regedit and reboot.

Warning: This tells Windows to skip ASN decode errors in signed files. Only use it if you trust the file source. I'd never run this on a production server—but for a single workstation with a stubborn driver, it's fine.

After reboot, try installing the file again. If the error's gone, you're done. If not, delete that DWORD and proceed.

The 15+ Minute Fix: Force Signature Verification from Command Line

When the registry tweak doesn't cut it, you need to manually verify the signature chain. I use signtool from the Windows SDK. It's more precise than the GUI.

1. Download and install the Windows SDK (just the signing tools component is enough).
2. Open Command Prompt as Administrator.
3. Run: signtool verify /pa /v "C:\path\to\your\file.ext"

Look at the output. It'll show you exactly where the ASN decoding failed—usually at a certificate in the chain. Common triggers: expired intermediate CA certs or malformed OIDs.

If the file's signature chain includes an old SHA-1 certificate that Windows 10/11 no longer trusts by default, you can enable SHA-1 for that session:

c:\ signtool verify /pa /v /sha1 "C:\path\to\file.ext"

Still failing? Open the file in a hex editor (I use HxD). Search for the ASN.1 sequence marker (0x30 0x82). If you see garbage bytes before it, the signature block is damaged. I had a client last month whose antivirus had quarantined part of a .cat file—restoring it from quarantine fixed the error instantly.

Finally, if you're dealing with a .cat file for a driver, you can rebuild the catalog using makecat. But honestly, that's a rabbit hole—easier to get a fresh copy from the vendor.

When All Else Fails: Disable Driver Signature Enforcement (Temporarily)

This is a last resort. I don't like it, but sometimes a legacy driver just won't play nice with modern Windows.

1. Hold Shift and click Restart.
2. Go to Troubleshoot > Advanced Options > Startup Settings > Restart.
3. Press 7 to disable driver signature enforcement.
4. Install your driver.

Reboot normally after installation—the driver stays installed, and signature enforcement turns back on. This got an old scanner working for a client's accounting office last year.

Bottom line: DIGSIG_E_DECODE is almost always a corrupt or outdated signature, not a system problem. Replace the file first, then the registry tweak, then the command line. You'll rarely need the last two.