Fix Install Error 0x800b010a: Steps That Work

Install error 0x800b010a is a Windows Update and component installation failure caused by a corrupted or missing digital certificate chain. You can usually fix it by resetting the Windows Update components, clearing the SoftwareDistribution cache, and re-registering the cryptographic services — the steps below walk through that process in order.

What Error 0x800b010a Actually Means

The code 0x800b010a translates to TRUST_E_BAD_DIGEST or CERT_E_REVOKED depending on the exact context, but in practice it appears when Windows cannot validate the digital signature on an update package or driver. Digital certificates are how Windows verifies that a file came from Microsoft and was not altered in transit. When that verification fails, the installer refuses to proceed and throws this error.

You are most likely to see 0x800b010a in three places:

Windows Update failing to download or install a cumulative update
Installing a driver or application that uses a signed cabinet (.cab) file
Running the DISM or System File Checker tool and hitting the error mid-scan

The underlying cause is almost always a broken certificate store, an outdated root certificate, or a system file that has been corrupted by a previous failed update. It is not caused by your hardware or by the specific program you are installing — it is a Windows-level trust issue.

Why the Certificate Chain Breaks

Windows maintains a local store of root certificates and intermediate certificates. When an update arrives, the installer checks the signature against that store. If the required root certificate is missing, expired, or has been overwritten by a third-party security tool, the chain cannot be built and the error appears.

Common triggers include:

Antivirus or firewall software intercepting and modifying the update download
A previous update that was interrupted mid-install, leaving partial files
Manual deletion of files in the SoftwareDistribution folder
System clock set to the wrong date, which makes certificates appear expired
Using a third-party “cleaner” that removes certificate store entries

It is also possible for the Windows Update service itself to be in a bad state, which prevents the certificate refresh mechanism from working. That is why the fix sequence below starts by stopping services and ends by restarting them.

Before You Start: Check the Basics

Two quick checks can save you from a long troubleshooting session. First, verify the date and time are correct: right-click the clock, choose Adjust date/time, and turn on Set time automatically. A wrong date makes every certificate look invalid. Second, temporarily disable any third-party antivirus or firewall — do not disable Windows Defender permanently, just pause real-time protection for the duration of the fix. If the error disappears with the antivirus off, add an exclusion for the C:\Windows\SoftwareDistribution folder instead of keeping the antivirus disabled.

If those checks do not help, move on to the full reset procedure.

Fix 1: Reset Windows Update Components (Recommended)

This is the most reliable fix for 0x800b010a. It stops the update services, clears the cache, re-registers the DLL files, and restarts everything. Run Command Prompt as administrator (search cmd, right-click, Run as administrator) and enter these commands one at a time:

net stop wuauserv — stops Windows Update
net stop cryptSvc — stops the cryptographic service
net stop bits — stops Background Intelligent Transfer
net stop msiserver — stops the Windows Installer service
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old — renames the update cache folder
ren C:\Windows\System32\catroot2 catroot2.old — renames the certificate store folder
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

After the last command, restart your PC and try the update again. The .old folders are safe to delete after you confirm the update installs successfully — they are just backups. If the error persists, move to the next fix.

Fix 2: Run DISM and System File Checker

Corrupted system files can also break the certificate validation. The Deployment Imaging Service and Management (DISM) tool repairs the Windows image, and System File Checker (SFC) repairs individual files. Run them in this order:

Open Command Prompt as administrator.
Type DISM /Online /Cleanup-Image /RestoreHealth and press Enter. This can take 10–20 minutes.
When it finishes, type sfc /scannow and press Enter.
Restart the PC after both complete.

If DISM reports that it cannot repair the image, you may need to use the Windows installation media as a repair source. The command DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\repairSource\install.wim is one option, but that requires an existing Windows image file. In most cases, the online repair works.

Fix 3: Update Root Certificates Manually

If the certificate store itself is outdated, you can refresh it through Windows Update. Go to Settings > Update & Security > Windows Update and click Check for updates. Microsoft periodically releases updates to the root certificate list, and installing those can resolve the error.

For an offline approach, download the latest root certificate update package from the Microsoft Download Center (search for “Update for Root Certificates”). This is a standalone .msu file that you can install without an internet connection. However, this only helps if the problem is specifically an outdated root store — if the store is corrupted, the reset in Fix 1 is the better path.

Fix 4: Use the Windows Update Troubleshooter

Windows includes a built-in troubleshooter that automates many of the steps above. Go to Settings > Update & Security > Troubleshoot > Additional troubleshooters, select Windows Update, and run it. It will check for common issues like service misconfigurations and pending reboots. It is not as thorough as the manual reset, but it is a good middle step if you prefer not to type commands.

If the troubleshooter finds nothing, try the manual reset — it covers more ground.

Frequently Asked Questions

Will this error damage my computer?

No. The error only prevents an update or driver from installing. It does not indicate hardware failure or data loss. Your system continues to run normally, just without the update.

Can I ignore 0x800b010a?

You can ignore it temporarily, but the update will keep failing and may block future updates. Security updates are important, so it is best to resolve the error within a few days.

Do I need to reinstall Windows to fix this?

Almost never. The reset and DISM steps resolve the vast majority of cases. Reinstalling Windows is only a last resort if the system is severely corrupted and no repair tool works.

Why does the error keep coming back after a fix?

If the error returns, the cause is likely an antivirus that keeps modifying the certificate store, or a scheduled task that resets the update services. Check your antivirus logs and add exclusions for Windows Update folders.

Is this error related to a specific Windows version?

It appears on Windows 7 through Windows 11, but it is most common on Windows 10 and 11 because those versions receive frequent cumulative updates. The fix steps are identical across all versions.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →