NS_E_DRM_INVALID_CERTIFICATE (0xC00D28A0) in Silverlight DRM fix

When this error shows up

You're on a streaming site that still uses Silverlight—maybe an older Netflix client, a university media portal, or a niche sports replay service. You click play, the player loads, then nothing. Just that error code 0xC00D28A0 in the browser console or a popup saying "NS_E_DRM_INVALID_CERTIFICATE".

The trigger is always an attempt to play protected content (DRM-encrypted) that requires Silverlight's PlayReady component. It's not a network issue—the server is fine. The problem is local.

What's actually happening here

Silverlight stores DRM certificates in a hidden folder under %ProgramData%\Microsoft\PlayReady. These certificates are downloaded once from the licensing server and then reused. What happens is one of these files gets corrupted—maybe from a crash while writing, a disk error, or an incomplete update from a previous session. Silverlight can't verify the signature on the cert, so it refuses to play the stream.

The key thing: the client's certificate itself isn't the problem. The problem is the stored copy. Deleting it forces Silverlight to download a fresh one from the server. That's the fix.

The fix: clear the DRM store

1. Close all browsers — Internet Explorer, Edge, Chrome, Firefox, whatever uses Silverlight. If any browser has the DRM module loaded, file deletion will fail.
2. Open File Explorer and paste this into the address bar: %ProgramData%\Microsoft\PlayReady. Hit Enter.
3. Delete everything in that folder. You'll see files like IndivBox.key, license.xml, and maybe a mspr.hds. Select all (Ctrl+A), delete. Windows might ask for admin permission—click Yes.
4. Open a Command Prompt as Administrator — hit Start, type cmd, right-click, Run as administrator. Run this command: net stop SamSs. That's the Security Accounts Manager service. Wait 5 seconds, then net start SamSs. This clears any lingering handles Silverlight might have on the DRM files.
5. Reboot. Straightforward—restart the machine. This ensures the new DRM data is built from scratch.
6. Try the stream again in the same browser. You'll see a brief "Acquiring license" or "Loading DRM" message as Silverlight downloads a fresh certificate.

If it still fails

Two things to check:

• Date/time sync — DRM certificates are time-sensitive. If your system clock is off by more than a few minutes, the signature check fails. Go to Settings > Time & Language > Date & time, toggle "Set time automatically" off and on, then click "Sync now".
• Corrupted installer — Silverlight's own installation can be damaged. Uninstall it (Programs and Features), then reinstall from Microsoft's archive (you'll need the offline installer, since the web setup redirect is dead). Version 5.1.50918 is the last stable release.

If neither helps, the problem is server-side—their licensing endpoint changed and your old cert is simply invalid. Nothing you can do locally except wait for them to fix it.