Fix CRYPT_E_RECIPIENT_NOT_FOUND 0x8009100B in Windows

You're trying to open an encrypted email in Outlook or decrypt a file with Windows, and you get this: CRYPT_E_RECIPIENT_NOT_FOUND (0x8009100B) — the exact message says "The enveloped-data message does not contain the specified recipient."

This usually happens when you import a new certificate but keep the old one, or when someone sends you an encrypted message using a certificate you no longer have. I see it a lot after people reinstall Windows or move to a new machine without exporting their private key.

Why this happens

The encrypted data has a list of recipients — it's wrapped (enveloped) so only certain certificates can open it. Your system looks up your installed certificates to find one whose public key matches. If the matching certificate is missing, or the private key isn't attached, Windows can't decrypt and throws 0x8009100B.

What's actually happening is that the message was encrypted for a certificate that either:

• Wasn't imported into your current Windows certificate store
• Has no private key (you imported only the .cer public cert)
• Got replaced by a newer cert but the sender still used the old one

Fix it — step by step

Step 1: Find which certificate was used

Ask the sender to check what certificate they encrypted with. If it's your own email, look at the encrypted message properties in Outlook: open the message, click File > Properties, then look at the Security section. It should list the encryption certificate. Write down the serial number or subject name (like "John Doe - email@example.com").

Step 2: Check your current certificates

certlm.msc

Open this by hitting Win+R, typing certlm.msc, and pressing Enter. This opens the local machine certificate store. Expand "Personal" > "Certificates". Look for a certificate that matches the one the sender used. If you see it but there's no key icon on it, you've got only the public certificate — not enough to decrypt. That's your problem.

Step 3: Import the correct certificate with private key

You need the .pfx or .p12 file that includes the private key. If you have it saved from before:

1. Right-click the "Personal" folder in certlm.msc
2. Choose All Tasks > Import
3. Browse to your .pfx file
4. Enter the password when asked
5. Check "Mark this key as exportable" — this lets you back it up later
6. Place it in the Personal store
7. Finish

If you don't have the .pfx, you can't decrypt. The sender must re-encrypt with your new certificate.

Step 4: Make sure the private key is accessible

After importing, double-click the certificate in the list. Go to the General tab — it should say "You have a private key that corresponds to this certificate." If it doesn't, the import failed. Try again, making sure the password is correct and the file isn't corrupted.

Step 5: Restart Outlook or your app

Close and reopen Outlook. Try to open the encrypted message again. The error should be gone.

If it still fails

Check a few more things:

• The sender's certificate: They might be encrypting with an expired or revoked certificate. Ask them to check their own cert's validity date.
• Wrong store: You might have the cert in the Current User store instead of Local Machine. Try certmgr.msc instead of certlm.msc and check under Personal there too.
• Group policy: Some corporate machines have policies that restrict which certs can be used. See your IT team if you're on a domain.
• Corrupt profile: Rare, but rebuilding your Windows profile can fix weird store issues. Try a test user account first.

One more thing — if you recently renewed your certificate and got a new one, the old encrypted emails are permanently locked unless you kept the old private key. Always export your old cert before renewing.