Step 1: Quick Registry Fix (30 Seconds)
Open Regedit (Win+R, type regedit, hit Enter). Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType\0If that key doesn't exist, create it. Right-click on OID → New → Key → name it EncodingType, then under that create a key named 0 (just the number zero). Inside the 0 key, create a DWORD (32-bit) named DisableTraceWindow. Set its value to 1.
Why this works: The error code 0x80093018 translates to OSS_CANT_OPEN_TRACE_WINDOW — it means the ASN.1 parser (used for certificates) can't open its debug trace window. Usually because of a sandboxing tool or Windows Defender's tamper protection blocking it. This reg key kills the trace window attempt entirely. Restart your app that was failing, and you're done.
If the error keeps happening, move to Step 2.
Step 2: Fix File Permissions (5 Minutes)
The culprit here is almost always the %SystemRoot%\System32\catroot2 folder getting locked down. Open an admin command prompt:
icacls %SystemRoot%\System32\catroot2 /grant SYSTEM:(OI)(CI)F
icacls %SystemRoot%\System32\catroot2 /grant Administrators:(OI)(CI)F
icacls %SystemRoot%\System32\catroot2 /grant Users:(OI)(CI)RXThen rebuild the certificate store:
net stop cryptsvc
net start cryptsvcI've seen third-party antivirus (especially McAfee and Symantec) lock this folder. Disable real-time scanning temporarily if the error still shows after the icacls commands. Run certutil -store my to check if certificates load — if you get the same error, the store itself is corrupt.
One more thing: check the Event Viewer (Applications and Services Logs → Microsoft → Windows → CAPI2 → Operational) for Event ID 11 or 90. Those logs tell you exactly which certificate file is failing. Usually it's a malformed .cer or .p7b file.
Step 3: Advanced Repair (15+ Minutes)
If steps 1 and 2 didn't fix it, you've got a deeper corruption. Don't bother with SFC or DISM — they rarely help here. The real fix is rebuilding the certificate stores manually.
Open PowerShell as admin. Run:
Get-ChildItem -Path Cert:\LocalMachine -Recurse | ForEach-Object { try { $null = $_.Handle } catch { Write-Warning "Corrupted cert: $($_.Thumbprint) - removing"; Remove-Item -Path $_ -Force } }That PS script tries to open every certificate's handle. If a cert is borked, it deletes it. After that, re-import the good certs from a backup or re-enroll with your CA.
Still failing? The problem might be in the user profile store instead of the machine store. Run the same PS script against Cert:\CurrentUser:
Get-ChildItem -Path Cert:\CurrentUser -Recurse | ForEach-Object { try { $null = $_.Handle } catch { Write-Warning "Corrupted cert: $($_.Thumbprint) - removing"; Remove-Item -Path $_ -Force } }I've had to do this on Windows 10 22H2 and Server 2022 after a dodgy Group Policy pushed a broken certificate. The error showed up in Outlook, Chrome, and any app that called CryptDecodeObject for ASN.1 data.
Final note: If you're still stuck, check if the failing app is trying to decode a custom ASN.1 structure (e.g., a third-party encryption tool). The error can also come from CryptStringToBinaryA calls. In that case, the fix is to update the app — not Windows.