Fix OSS_MORE_INPUT 0X80093004 Certificate Error

What's Actually Happening Here

The error 0X80093004 with message "OSS_MORE_INPUT" shows up when Windows tries to decode a certificate file that's missing some parts. Usually it's because the file got cut off during download, or you're trying to import the wrong format. I've seen this mostly with PFX files from older certificate authorities or when someone copies a certificate from an email but forgets to include the full chain.

Here's the fix path. Start with step 1 – it takes 30 seconds. If that doesn't work, move to step 2. Step 3 is your last resort, but it works.

Step 1: Check the File Size (30 seconds)

Open File Explorer, right-click the certificate file, pick Properties. Look at the Size field.

If it's 0 KB or under 100 bytes – the file is empty or corrupt. Redownload it.
If the file is a .pfx, it should be at least 1–2 KB. Smaller than that and it's missing data.
If the file is a .cer or .p7b, check it's not just a snippet. A real certificate starts with -----BEGIN CERTIFICATE----- (for text formats) or has readable binary headers.

Why this works: The error means the ASN.1 parser ran out of data mid-parse. If the file is small, the parser never got enough bytes to validate the structure. Redownload from the source, ideally using a direct link, not a forwarded email.

// Quick check in PowerShell to see file size in bytes
Get-Item ".\yourfile.pfx" | Select-Object Length

Step 2: Re-export the Certificate Correctly (5 minutes)

If the file size looks normal, the problem is likely an incomplete export. Here's how to get a clean export from the source machine.

If you can access the source computer:

Open certmgr.msc (certificate manager for current user) or certlm.msc (local machine).
Find the certificate under Personal or Trusted Root Certification Authorities.
Right-click it, go to All Tasks > Export.
Choose Yes, export the private key if it's a PFX you need.
Check Include all certificates in the certification path if possible – this is critical. Many people skip it, and the exported file becomes incomplete.
Set a password (required for PFX).
Save as PFX (not PKCS7, not DER). PFX is the safest for import.

If the source is a Linux machine or web server:

Make sure you export the full chain, not just the leaf certificate. Use OpenSSL:

openssl pkcs12 -export -in certificate.crt -inkey private.key -certfile ca-bundle.crt -out fullchain.pfx

The -certfile flag adds intermediate and root certificates. Without it, your PFX will be missing CA chain info, and Windows will throw OSS_MORE_INPUT when trying to build the chain.

Why step 2 fixes it: The OSS_MORE_INPUT error often comes from a malformed ASN.1 sequence. When you export without chaining, the PFX file structure is technically valid but incomplete. The parser expects more data for the root or intermediate, finds nothing, and errors out.

Step 3: Manually Rebuild or Repair the Certificate (15+ minutes)

If steps 1 and 2 didn't work, the certificate file itself might be genuinely broken. This happens with old certificates exported from Windows Server 2003 or from some third-party CAs that used non-standard encoding.

Option A: Use certutil to decode and re-encode

Open an admin PowerShell or Command Prompt.
Run: certutil -dump yourfile.pfx
Look at the output. If it says "0x80093004 (OSS_MORE_INPUT)" at some point, note where it stops.
Try converting to PEM and back:

# Convert PFX to PEM (password protected)
openssl pkcs12 -in yourfile.pfx -nodes -out temp.pem

# Convert PEM back to PFX with all chain
openssl pkcs12 -export -in temp.pem -out repacked.pfx -name "My Cert" -caname root

This strips any formatting issues and re-encodes the ASN.1 properly. I've used this trick dozens of times on certificates from 2008-era CAs.

Option B: Extract and re-import only the leaf

If the chain is hopelessly broken, try importing just the leaf certificate without the chain.

Run certutil -decode yourfile.pfx decoded.cer (only works if PFX is base64).
If that fails, use OpenSSL to extract: openssl pkcs12 -in yourfile.pfx -nokeys -out cert.pem
Import the cert.pem via the Certificate Import Wizard, choosing Automatically select the certificate store.

Warning: This option won't give you the private key. Use it only if you need the public certificate for verification, not for encryption or signing.

Final Things to Know

The error code 0X80093004 is specific to the Windows OSS ASN.1 decoder. It won't appear on Linux or macOS – those systems use different parsers that might not even complain about broken encoding.
If you're importing a certificate from an email attachment, the file often gets truncated by the email system. Ask the sender to upload it somewhere and give you a direct link.
Never rename a file extension (like changing .cer to .pfx) – Windows uses the extension to decide which decoder to run. Mixing them up triggers parsing errors.
If none of this works, the certificate is probably beyond repair. Contact your CA and request a new export.

Short version: check file size, re-export with full chain, or repack with OpenSSL. One of these will save you.