Intel PTT EK certificate service returns 404 "Certificate not found" — TPM attestation fails (Z790, i9-14900F)

The EK certificate itself must be issued and hosted by Intel’s EK certificate service; Windows and Microsoft’s attestation services only consume what Intel publishes. When Intel’s EK service returns HTTP 404 for a valid EK key ID, that is an Intel provisioning/back‑end issue, not something that can be fixed from Windows, firmware settings, or by reinstalling software.

From the Windows and Microsoft side, the relevant points from the documented flow are:

• The TPM endorsement certificate is created and stored by the TPM/firmware vendor and is used as the root of trust for attestation.
• For Intel firmware TPM, the endorsement certificate is obtained online from Intel and stored in the TPM. If Internet access is filtered, the Intel EK service URL must be reachable: https://ekop.intel.com/ekcertservice.
• Windows then uses that EK to derive an Attestation Identity Key (AIK) and obtains an AIK certificate from the Microsoft Cloud CA. If the EK certificate cannot be validated or retrieved, AIK enrollment can fail.

Relevant behavior from the documentation:

• The endorsement certificate is produced by the TPM manufacturer and is used to prove the authenticity of the TPM to applications or cloud services.
• For Intel firmware TPM, the endorsement certificate is created when the TPM is initialized by contacting Intel’s online service.
• Windows health/TPM attestation relies on the EK and AIK chain; Microsoft Cloud CA issues the AIK certificate only after it can establish that it is talking to a real TPM with a valid EK.

Given that:

1. The EK chain reads correctly on the device and chains to Intel’s root.
2. The issuing CA is present in Microsoft’s TrustedTPM list.
3. Intel’s EK service returns 404 for the EK key ID.
4. Microsoft’s AIK enrollment endpoint then also returns 404 for that key ID.

This indicates that the Intel EK certificate for this specific EK key ID is not present/registered in Intel’s EK service back end. Microsoft’s attestation service cannot work around a missing EK record; it depends on Intel’s service to provide the EK certificate and associated metadata.

From the Windows side, the only actionable checks are:

1. Ensure the Intel EK service URL is reachable from the device when the TPM is initialized:
   • https://ekop.intel.com/ekcertservice (for Intel firmware TPM) If this URL is blocked by a firewall or filtering, allow it and then clear and re‑initialize the TPM so the firmware can re‑provision the EK certificate.
2. Confirm Secure Boot and TPM are correctly enabled and owned, which is already the case in this configuration.

If the EK service remains reachable and still returns 404 for this EK key ID after TPM clear/re‑provision, the remaining step is to escalate to Intel (and, if needed, ASUS) support with:

• The EK key ID.
• The EK certificate chain as read from the TPM.
• Confirmation that https://ekop.intel.com/ekcertservice is reachable during TPM initialization.

Only Intel can provision or correct a missing EK certificate record in its EK service; Microsoft’s attestation and AIK issuance cannot compensate for a 404 at Intel’s endpoint.

References:

• Control the health of Windows devices
• Enable TPM 2.0 on your PC
• TPM Key Attestation