Fix CERT_E_INVALID_POLICY 0x800B0113 on Windows

Happens when Windows can't verify a certificate's policy constraints. Usually blocks HTTPS connections to corporate or self-signed sites. No, your Wi-Fi isn't broken.

When does 0x800B0113 actually hit?

You're trying to open a company intranet page, a self-hosted app, or maybe a legacy SharePoint site. Instead of loading, you get a red page in Edge, a certificate error in Chrome, or a plain "Cannot find server" in IE. The exact error in the certificate details reads: The certificate has invalid policy. Error code 0x800B0113. You check the clock — it's correct. You check the root CA — it's installed. Still broken.

What's actually happening here?

Windows certificate chain building doesn't just check if the root CA is trusted. It also validates policy constraints — extensions in the certificate that say "this cert is only valid for these usage purposes." The error means the certificate has a policy extension that Windows can't match to any trusted policy OID in your system's certificate store. Think of it like a passport: the stamp is real, but the visa type isn't recognized by border control.

This usually happens because:

The server's certificate includes a Certificate Policies extension (OID 2.5.29.32) with a policy OID that isn't in the client's trusted policy store.
Or a CA in the chain issued a certificate with a Policy Constraints extension that forbids the leaf cert's policy.
Or (most common) the intermediate CA has a policy mapping that points to an OID not present on the machine.

The fix: three steps

Step 1 — Find the exact policy OID that's failing

Don't guess. Use certutil to dump the certificate chain:

certutil -urlfetch -verify -v yourcertificate.cer

Look for the line Certificate Policies or Policy Mappings. You'll see something like 1.3.6.1.4.1.311.21.10. That OID is what Windows can't match. Write it down.

Step 2 — Add the missing policy OID to Windows

You need to add that OID as a trusted certificate policy. Use this command, replacing the OID with yours:

certutil -setreg CA\Policy\1.3.6.1.4.1.311.21.10 1

The 1 at the end means "allow." 0 would block it. This writes to the registry under HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config. You'll see it if you open regedit.

Step 3 — Clear the cached chain and retry

Windows caches certificate chain results aggressively. Force a refresh:

certutil -delstore -user Root ""
certutil -delstore -user CA ""

Then flush the chain cache:

certutil -setreg CA\CRL\URLRetrievalTimeout 0

Reboot, or restart the Cryptographic Services service. Try the URL again. If it works, you're done.

Why step 3 matters

Without clearing the cache, Windows reuses the failed chain result — even after you add the policy. The reason is architectural: the CryptoAPI chain engine stores validation results per-session. Adding the policy OID alone doesn't invalidate the cached failure. You have to nuke the stored chains.

What to check if it still fails

Group Policy: Domain machines often have a GPO that sets Certificate Path Validation Settings under Computer Configuration > Administrative Templates > System > Internet Communication Management. That can override your local registry change. Check with gpresult /h report.html.
Intermediate CA not trusted: The intermediate certificate might not be in the Intermediate Certification Authorities store. Use certlm.msc (local machine) to check. If missing, install it.
Wrong root CA: The root CA might be in the wrong store. Root CAs must be in Trusted Root Certification Authorities, not Intermediate. Move it if needed.
Anti-virus or firewall: Some AV suites (looking at you, McAfee and Symantec) inject their own certificate validation hooks. Temporarily disable SSL scanning to test.
Old Windows version: Pre-Win10 machines had a tighter policy validation engine. On Windows 7 or 8.1, you might need to manually install the missing policy OID via an admin template or registry. Skip that — upgrade.

Bottom line: this error is almost always a mismatch between what the server says its certificate is for and what your machine expects. The OID trick fixes it cleanly. If you can't modify the client, talk to whoever issued the cert — they can reissue with a policy OID that's already trusted.