What does HRESULT 0x80091008 (CRYPT_E_INVALID_INDEX) mean?

 
Previous Next
CRYPT_E_HASH_VALUE CRYPT_E_ALREADY_DECRYPTED

CRYPT_E_INVALID_INDEX

The caller requested a signer, recipient, certificate, CRL, or attribute by an index that is no longer valid for the current message state.

What to check for CRYPT_E_INVALID_INDEX

  • Validate bounds against the count returned for the currently decoded message.
  • After deleting a signer, certificate, CRL, or unauthenticated attribute through CryptMsgControl, reacquire indices; Microsoft documents that existing indices can become invalid.
  • Do not reuse cached index values across a new message handle or a new decode operation.

Microsoft: CryptMsgControl

Microsoft: CryptMsgGetParam

Diagnostic interpretation of CRYPT_E_INVALID_INDEX

CRYPT_E_INVALID_INDEX has the HRESULT value 0x80091008. AllStat records the condition as “The index value is not valid.”. For CRYPT_E_INVALID_INDEX, in practice, interpret that wording at the boundary owned by cryptography, certificate, trust, or key-provider processing, rather than treating the value as a generic Windows message.

Evidence to capture for CRYPT_E_INVALID_INDEX

  • Record the exact COM method or Windows API, its input object, the calling thread, and the full 0x80091008 value before a wrapper converts it to an exception or Boolean result.
  • Capture any IErrorInfo text, activity identifier, event-log entry, and subsystem trace that mentions CRYPT_E_INVALID_INDEX or the crypt / index operation.
  • For CRYPT_E_INVALID_INDEX, compare the failing machine with a working one at the same configuration boundary: component version, policy, registration, identity, and target resource.

Retry and recovery for CRYPT_E_INVALID_INDEX

Retry CRYPT_E_INVALID_INDEX only when the owning API documents a transient state or after the condition described as “The index value is not valid.” has changed. For CRYPT_E_INVALID_INDEX, configuration, policy, format, and authorization failures normally require correction first; an immediate loop can hide the original call site and add secondary errors.


Looking for a different code? Search another status or error code.