How to fix SCEP certificate enrollment failed?

Question

I am seeing Event ID error 87 in the Application Event log. The following is detail copy from the event:

Log Name: Application

Source: Microsoft-Windows-CertificateServicesClient-CertEnroll

Date: [Moderator's note: PII removed]

Event ID: 87

Task Category: None

Level: Error

Keywords: Classic

User: [Moderator's note: PII removed]

Computer: [Moderator's note: PII removed]

Description:

SCEP Certificate enrollment for Local system via https://INTC-KeyId- [Moderator's note: PII removed].microsoftaik.azure.net/templates/Aik/scep failed:

PkiStatus(11): SCEPDispositionPendingChallenge

EnrollStatus(32): EnrollUnknown

The operation completed successfully. 0x0 (WIN32: 0)

SubmitDone

SubmitV2Attestation: Bad Request

{"Message":"V2 Protocol AIK certificate requests with [Moderator's note: PII removed] ECC public keys are not supported. Public key algorithm: 1.2.840.10045.2.1, Key length: 256."}

HTTP/1.1 400 Bad Request

Date: [Moderator's note: PII removed]

Content-Length: 154

Content-Type: application/json; charset=utf-8

X-Content-Type-Options: nosniff

Strict-Transport-Security: max-age=31536000;includeSubDomains

x-ms-request-id: [Moderator's note: PII removed]

Method: POST(1406ms)

Stage: SubmitDone

Bad request (400). 0x80190190 (-2145844848 HTTP_E_STATUS_BAD_REQUEST)

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-CertificateServicesClient-CertEnroll" Guid="[Moderator's note: PII removed]" EventSourceName="CertEnroll" />

<EventID Qualifiers="49754">87</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime=[Moderator's note: PII removed] />

<EventRecordID>65505</EventRecordID>

<Correlation />

<Execution ProcessID="8968" ThreadID="0" />

<Channel>Application</Channel>

<Computer>NAME</Computer>

<Security UserID=" [Moderator's note: PII removed]" />
  </System>

  <EventData>

xml
<Data Name="Context">Local system</Data>

<Data Name="Url">https://INTC-KeyId- [Moderator's note: PII removed].microsoftaik.azure.net/templates/Aik/scep</Data>

<Data Name="MessageText">PkiStatus(11): SCEPDispositionPendingChallenge
EnrollStatus(32): EnrollUnknown

The operation completed successfully. 0x0 (WIN32: 0)

SubmitDone

SubmitV2Attestation: Bad Request

{"Message":"V2 Protocol AIK certificate requests with  [Moderator's note: PII removed] ECC public keys are not supported. Public key algorithm: 1.2.840.10045.2.1, Key length: 256."}

HTTP/1.1 400 Bad Request

Date: [Moderator's note: PII removed]

Content-Length: 154

Content-Type: application/json; charset=utf-8

X-Content-Type-Options: nosniff

Strict-Transport-Security: max-age=31536000;includeSubDomains

x-ms-request-id: [Moderator's note: PII removed]

</Data>

xml
<Data Name="Method">POST(1406ms)</Data>

<Data Name="Stage">SubmitDone</Data>

<Data Name="ErrorCode">Bad request (400). 0x80190190 (-2145844848 HTTP_E_STATUS_BAD_REQUEST)</Data>
  </EventData>

</Event>

Also, I clicked on the https  link in the details above and Edge opened with a few error lines.  First question:  Did clicking the link harm anything on the desktop?  Second question:  How do I fix this event error because Windows 11 Pro is fully updated and I have ran the following commands from an Administrator command prompt:

DISM.exe /Online /Cleanup-image /Restorehealth

sfc /scannow

Answer 1

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

---

Hi A123-26MQ,

Thank you for providing the event details.

Based on the error information, this Event ID 87 entry appears to be related to TPM/AIK (Attestation Identity Key) certificate enrollment rather than Windows file corruption. The message indicates that the attestation request was rejected during the certificate enrollment process, even though Windows itself may continue to function normally.

A few points that may help:

1, Opening the URL did not harm your PC - the link shown in the event log is an AIK certificate enrollment endpoint. Opening it in a browser does not make changes to your system.

2, Check for BIOS, UEFI, and TPM firmware updates

• Visit your PC manufacturer's support page.
• Install any available BIOS/UEFI or TPM firmware updates.
• Restart the device and monitor whether the event reappears.

3, Verify TPM status

• Open Windows Security > Device Security > Security Processor details.
• Confirm that the TPM reports as working properly.

If BitLocker, Windows sign-in, and other security features are working normally, this event may be informational and not indicate a system problem. Similar SCEP enrollment errors have been reported without affecting normal operation.

I hope this helps clarify what you're seeing. Let me know if you need further assistance, feel free to ask me by clicking "Add Comment" or "Add Answer" if you cannot add comment so your response will be visible. Thanks for your effort.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.