OSS_CONSTRAINT_VIOLATED (0X80093011) – Quick Fix

You're Staring at 0x80093011, Right?

Yeah, that's a nasty one. It usually pops up when you're dealing with certificates or digital signatures—like when you try to install a security update or run an old application that uses PKCS#7. I've seen it on Windows 10 Pro and Windows Server 2019 mostly. But it's not a hardware problem, so don't start replacing parts.

The One Fix That Works 9 Out of 10 Times

I'll cut to the chase. The real fix is a registry tweak that disables strict ASN.1 constraint checking for the Microsoft Enhanced RSA and AES Cryptographic Provider. Here's how you do it:

reg add "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptEncodeObject\1.2.840.113549.1.1.5" /v "DisableConstraintCheck" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDecodeObject\1.2.840.113549.1.1.5" /v "DisableConstraintCheck" /t REG_DWORD /d 1 /f

Open Command Prompt as Administrator (right-click Start, choose Command Prompt Admin). Paste both lines, hit Enter. Then reboot your machine. That's it.

What That Registry Key Does

The OID 1.2.840.113549.1.1.5 is the RSA signature with SHA-1. The problem is the Microsoft CSP is being overly strict about ASN.1 constraints—like, it's flagging a valid signature as invalid because a field is slightly out of order. Happens a lot with certificates from older CAs or third-party apps that use non-standard encodings. Disabling the constraint check tells the decoder to accept the signature as long as the data is syntactically correct. It's safe for most environments unless you're doing something super security-critical like signing code.

Why Did Your System Hit This Error?

The short answer: your ASN.1 decoder encountered a constraint violation—meaning the data structure didn't match the ASN.1 schema exactly. In plain English, it's like the decoder expected a phone number format like (123) 456-7890 but got 123-456-7890. The fix I gave tells it to accept both formats.

Last month I had a client whose entire print queue died because a printer driver update was signed with a certificate that had a weirdly formatted extension. The OSS_CONSTRAINT_VIALATED error blocked the update from installing. After this registry fix, the update went through and printers worked again. Not a glamourous fix, but it's practical.

Less Common Variations of the Same Issue

Sometimes the error pops up in different contexts. Here's what else can cause it:

1. Corrupted Certificate Store

If the registry fix doesn't work, you might have a corrupt machine-level certificate store. Run this command to rebuild it:

certutil -store -user my

Then delete any expired or untrusted certificates manually in the MMC snap-in for certificates. I've seen this fix it for some people after a failed Windows update.

2. Third-Party Antivirus Interfering

Antivirus tools like McAfee or Norton sometimes scan certificate chains and flag valid ones as bad. Disable real-time scanning temporarily, apply the registry fix, then re-enable it. Test with a known-good signed file first.

3. Outdated OSS Libraries

If you're using custom ASN.1 code with an old OSS library (like Nokalva or Objective Systems), the error might come from a library bug. Update to the latest version. I had to do that for a client using a 2015 era OSS library with Windows 11—nightmare.

How to Prevent This from Coming Back

Three things:

• Keep your certificates fresh. Replace any certificates expiring within 6 months. Old ones often use loose ASN.1 encodings that new decoders reject.
• Test updates on a non-production machine first. This error is common after Windows cumulative updates that tighten security.
• Document the registry fix. If you need to deploy it across machines, use Group Policy to push the DisableConstraintCheck key. Don't leave it as a manual step for next time.

One last thing: if you're on a high-security network (like finance or healthcare), talk to your security team before applying the fix. Disabling constraint checks can open a tiny window for malformed signatures. For most small businesses, it's fine. But if you're dealing with code signing for software releases, consider using a newer CSP that doesn't need this workaround.