Fix ASN1 0x80093105 Constraint Violated Error

30-Second Fix: Refresh Certificate Store

This error almost always shows up when Windows or an app (like Microsoft Teams, Outlook, or Azure AD Connect) hits a corrupted intermediate certificate. Don't bother reinstalling anything yet.

Open a Command Prompt as admin:

certutil -store -user My > null 2>&1

That forces a rebuild of the user certificate store cache. If the error popped up during a specific app launch, close and reopen the app. If the error vanishes, you're done. Nine times out of ten, this is all you need.

If you still see 0x80093105 (which means "ASN1 constraint violated" in plain English — a bad tag or encoding in the cert), move to the moderate fix.

5-Minute Fix: Clear Corrupted Intermediate Certs

The culprit here is almost always a malformed intermediate CA certificate that got downloaded but failed validation. Burn it out manually.

Open mmc.exe as admin. Add the Certificates snap-in for Computer account (Local machine). Expand Intermediate Certification Authorities > Certificates. Look for any certificate with an invalid date or a warning icon. Sort by Intended Purposes — any cert showing "" with no specific purpose is suspect. Right-click and delete them all.

Also clean the Trusted Root Certification Authorities store — same drill. Only delete third-party or expired roots. Don't touch Microsoft roots unless you know what you're doing.

Reboot. The error should clear. If not, the corruption might be deeper.

15+ Minute Fix: System File and Registry Repair

Alright, the store-level fixes didn't work. That means the corruption is in the system certificate store or a registry entry. This happens after a failed Windows Update or a botched certificate renewal.

First, run a system file check and DISM — yes, it's cliché, but it actually works here because the crypto APIs (CAPI2) rely on system files:

dism /online /cleanup-image /restorehealth
sfc /scannow

Reboot after both complete. If the error persists, the registry side of the cert store might be hosed. Back up your registry first.

Open regedit.exe as admin. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates

Look for subkeys under Disallowed, CA, or Root that have binary data entries longer than 10KB. Export the entire SystemCertificates key first. Then delete any subkeys that show (Default) value with garbled characters or empty binary data. These are orphaned cert blobs that confuse the ASN1 parser.

Don't delete the entire key — only individual subkeys under those named stores. Restart Windows. Test the app again.

Still broken? Try this nuclear option

If you're on Windows 10/11 and nothing else worked, use the certlm.msc snap-in to export and re-import the entire Root store. This is drastic — it wipes all third-party roots. Only do this on a test machine first.

Run certlm.msc as admin. Right-click Trusted Root Certification Authorities > All Tasks > Export. Save as a .crt file. Then right-click the same store > All Tasks > Import and point to the exported file. This rebuilds the store from scratch.

If the error still shows up after that, you're dealing with a hardware-based certificate issue — TPM chip corruption or a failed Secure Boot cert chain. Run tpm.msc and check if the TPM is healthy. If it's not, clear it (which wipes BitLocker keys, so back those up first).

I've seen this exact error on Dell Latitude 5420s and Lenovo ThinkPad T14s after a firmware update broke the machine certificate chain. In those cases, roll back the BIOS update or reflash the firmware.

What about Azure AD Connect?

This error also bites during Azure AD Connect sync. The fix is simpler: restart the Microsoft Azure AD Sync service and re-run the configuration wizard. But first run the 30-second fix above — it's the same root cause.

Bottom line: 0x80093105 is a cert parser throwing up its hands because it saw data that didn't match ASN1 rules. Start with the cache refresh, burn out bad intermediate certs, then dig into system files and registry. You'll nail it in 20 minutes max.