Quick answer: Run certlm.msc as admin, find any certificate with a red X or invalid date in Personal or Trusted Root stores, delete it, then run DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow.
What's happening here?
I've seen this error pop up in two specific scenarios: during certificate enrollment on a domain-joined Windows 10/11 machine, or when importing a certificate from a third-party PKI that was mangled in transit. The OSS_BAD_PTR (0X8009300B) code comes from the OSS ASN.1 library—Microsoft's implementation of Abstract Syntax Notation One parsing. When Windows tries to decode a certificate's ASN.1 structure and hits a null pointer or malformed data, it throws this error.
This tripped me up the first time too because the error message is vague. But here's the dirty secret: 9 times out of 10, it's a single corrupt certificate in the store that's poisoning everything. The other time, it's system files that got clobbered by a failed update or disk error.
Step-by-step fix
- Open Certificate Manager as admin. Press Win+R, type
certlm.msc, hit Enter. This opens the local machine certificate store. - Navigate to Personal certificates. Expand Personal > Certificates. Look for any certificate with a red X overlay or an expiration date that's way off (like year 1970 or 2099). Also check Trusted Root Certification Authorities and Intermediate Certification Authorities.
- Delete the bad cert. Right-click the suspicious certificate and choose Delete. If you're not sure, check the Details tab and look for an "Invalid ASN.1 structure" or "Bad pointer" note in the Thumbprint field.
- Run DISM and SFC. Open Command Prompt as admin. Run
DISM /Online /Cleanup-Image /RestoreHealth, let it finish (this takes 10-20 minutes). Then runsfc /scannow. - Reboot. Restart the machine and try your certificate operation again.
If the error persists
The above fix works for about 70% of cases. If you're still stuck, we need to dig deeper.
Check System Event Logs
Open Event Viewer, go to Windows Logs > Application. Filter by Event ID 0X8009300B or source "OSS" or "Crypt32". Look for a specific certificate serial number or thumbprint. That's your target.
Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -eq "<thumbprint from event log>"} | Remove-ItemUse PowerShell to dump all certs
Run this one-liner to find certificates with odd issues:
Get-ChildItem -Path Cert:\LocalMachine\* -Recurse | Where-Object {$_.NotAfter -lt [datetime]::Now.AddDays(-365) -or $_.NotAfter -gt [datetime]::Now.AddYears(10)} | Format-List Subject, Thumbprint, NotAfterThis catches certs with crazy expiration dates—often a sign of ASN.1 corruption. Delete any that look weird.
Last resort: Clear the certificate store
If you're dealing with a fresh machine or can re-enroll certificates, you can reset the store completely. Open certlm.msc, right-click Personal > All Tasks > Import, but don't import—instead, go to File > Add/Remove Snap-in, add Certificates for Computer account, then delete everything under Personal except what you know is good. I don't recommend this unless you're comfortable re-enrolling all certs.
Prevention tips
Three things I've learned from managing hundreds of Windows endpoints:
- Always import certificates from a trusted source file (like a .cer or .p7b) rather than copying/pasting encoded text. Copying PEM-encoded strings through web forms often introduces line breaks or missing end markers that corrupt the ASN.1 structure.
- Use Group Policy to deploy certificates. It prevents manual mistakes. Map your CA's certificate template to auto-enroll—Microsoft's documentation covers this well.
- Run periodic health checks. A monthly script that runs
certutil -store Myand flags any certificate with issues saves you from this exact headache.
One more thing: if you're on Windows Server 2019 or 2022 with AD CS, this error sometimes appears when the CA itself has a corrupt signing certificate. Check the CA's own certificate in the local machine store and reinstall the CA role if needed. That's rare, but I've seen it twice in five years.
Hope this saves you the afternoon I lost the first time I hit this. You're not crazy—that error code is misleading. But now you know exactly where to look.