Fix NTE_EXISTS 0X8009000F: Clear Stuck Key Container

That error is a pain, I know. You're trying to import a certificate or create a key and Windows just says "nope, already exists." Let's fix it.

The Direct Fix

Open PowerShell as Administrator. You need to find the key container that's stuck, delete it, then retry your original operation.

Click Start, type PowerShell, right-click it, and choose Run as administrator.
Run this command to list all key containers for the current user:

certutil -key

You'll see a list of key container names. Look for one that matches the certificate name or something you don't recognize. Write down the exact name — it's case-sensitive.

Delete that key container:

certutil -delkey <container_name>

Replace <container_name> with what you found. After running it, you should see DeleteKey and a success message. No error means it worked.

Now try your import or key creation again. It should go through clean.

If you're on a Machine-level store

If the certificate is for the computer (like a web server), run this instead:

certutil -user -key

That shows keys for the machine account. Delete with:

certutil -user -delkey <container_name>

Why This Works

The 0x8009000F error shows up because Windows already has a key container with the same name. This happens when a previous import or key generation partially failed — the container gets created but the certificate never lands. So every time you try again, Windows says "that name's taken."

The certutil -delkey command wipes that leftover container. It's the quickest way to clear the blockage without rebooting or reinstalling anything.

Less Common Variations

You can't see the key in certutil

Sometimes the key is hidden. Try using the CryptoAPI directly with PowerShell:

Get-ChildItem -Path Cert:\CurrentUser\My

That lists certificates in your personal store. If you see a duplicate, delete it:

Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Thumbprint -eq "YOUR_THUMBPRINT"} | Remove-Item

Replace YOUR_THUMBPRINT with the actual thumbprint (without spaces).

It's on a remote machine

If you're managing a server remotely, use the -Machine switch:

certutil -machine -delkey <container_name>

Or use winrm to connect first, then run the command.

The error appears during a PKCS#12 import

When importing a .pfx file, the error can come from a mismatch between the key and certificate. Try exporting the pfx again from the source machine with a password you're sure about, then import it with the -ImportOptions flag:

certutil -importPFX -f my.pfx NoExport

The -f flag forces overwrite, and NoExport prevents the key from being exportable. If that still fails, delete the key container first as shown above.

Prevention for Next Time

The real fix is to avoid partial imports. Always use the same certificate name consistently. If you're generating a self-signed cert, delete the old one before creating a new one with the same subject.

Also, check your certificate store before importing. A quick certutil -store My shows what's already there. If you see a cert with the same name, either remove it or rename the new one.

And don't skip the -f flag when you know you're replacing an existing cert. It saves you from this exact headache.