Request to onboard Intel ODCA 2 CSME EK Certificate Chain of i9‑13900HX to Azure Attestation Trust List, AIK Enrollment HTTP 400 Failure

Question

Request to onboard Intel ODCA 2 CSME EK Certificate Chain of i9‑13900HX to Azure Attestation Trust List, AIK Enrollment HTTP 400 Failure

哥刀 0

To Microsoft Azure Attestation Engineering Team,

I am an end-user with a Thunderobot Hunter S gaming laptop equipped with Intel Core i9‑13900HX processor equipped with firmware-based Intel PTT (Platform Trust Technology) TPM 2.0.

Verified device configuration and local TPM status

1. BIOS settings: Secure Boot enabled, CSM disabled, factory default PTT activation, no BIOS flashing, firmware modification, registry tampering or any TPM alteration.

2. System Version: Windows 11 latest official stable build, all Windows security patches fully updated.

3. Local inspection via tpm.msc : On-board TPM 2.0 is healthy, functional and intact locally.

Core failure issue

When executing elevated command certreq -enrollaik to finish AIK remote attestation against endpoint microsoftaik.azure.net , the server returns HTTP 400 Bad Request consistently.

After exporting and analyzing the EK certificate chain via TpmDiagnostics, the root CA is Intel ODCA 2 CSME series certificate. This batch of 13900HX PTT-generated EK issuing certificates has not been onboarded into the global trusted repository of Microsoft Azure Attestation service.

Practical consequence triggered by attestation failure

RICOCHET anti-cheat of Call of Duty Warzone relies on Microsoft remote TPM EK attestation validation. The untrusted certificate chain leads to persistent pop-ups requiring users to update BIOS firmware, which restricts me from accessing multiplayer ranked game modes.

I have never tampered with system security modules or adopted cheating tools; this validation error originates from incomplete CA admission instead of improper operation on my side.

Actions I have implemented to troubleshoot

1. Restored official factory BIOS firmware released by laptop OEM Thunderobot to rule out customized firmware defects.

2. Submitted technical tickets to Intel Customer Support and the laptop manufacturer, requiring them to coordinate with Microsoft to complete certificate chain admission.

3. Posted relevant error logs and symptom descriptions on Microsoft Learn Azure Attestation community together with dozens of users owning identical HX-series CPUs suffering the same 400 attestation error.

Formal request

I sincerely apply for your engineering team to review the Intel ODCA 2 CSME certificate chain corresponding to the 13900HX batch of mobile processors, incorporate the relevant root CA into the Azure Attestation trusted list, so that the PTT TPM can complete standard EK remote attestation normally.我诚挚地申请贵方工程团队审核与13900HX批次移动处理器相对应的Intel ODCA 2 CSME证书链，并将相关根CA纳入Azure Attestation可信列表，以便PTT TPM能够正常完成标准的EK远程证明。

I am ready to submit exported EK chain files, command error screenshots and TPM inspection logs 我已准备好提交导出的EK链文件、命令错误截图以及TPM检测日志我已准备好提交导出的EK链文件、命令错误截图以及TPM检测日志

or technical audit at any time.

Danny Chapman 0 Reputation points

2026-08-07T19:44:49.2433333+00:00
I am also experiencing this issue and can confirm it is reproducible on my system.

The AIK enrollment consistently fails with:

Certificate Request Processor: Bad request (400) 0x80190190 (-2145844848 HTTP_E_STATUS_BAD_REQUEST) {"Message":"No valid TPM EK/Platform certificate provided in the TPM identity request message."}

My environment is:

Intel PTT (CSME) TPM 2.0

Windows 11

UEFI boot

Secure Boot enabled

Latest BIOS installed

Latest Intel ME/CSME firmware available from the OEM

The TPM appears to be healthy:

TpmTool GetDeviceInformation reports:

Ready For Attestation = True

Is Capable For Attestation = True

Ready For Storage = True

RSA and ECC Endorsement Keys exist.

EK certificates are present in TPM NVRAM.

TpmDiagnostics.exe EkInfo reports the expected EK certificates and intermediate certificates.

Troubleshooting already completed:

Cleared and reprovisioned the TPM.

Updated the BIOS to the latest version.

Confirmed Secure Boot is enabled.

Reset Secure Boot keys.

Installed the EK certificate from TPM NVRAM using:

TpmDiagnostics.exe InstallEkCertFromNVR

This completes successfully.

Attempting:

TpmDiagnostics.exe InstallEkCertFromWeb

fails with:

ASN1 bad tag value met. HR: 0x8009310B

I have also:

Reinstalled Intel TPM/CSME components.

Verified Windows is fully up to date.

Repeated AIK enrollment multiple times.

Tested using both certreq -enrollaik and the application's enrollaik.exe, both producing the same HTTP 400 response.

My EK certificate chain shows:

Issuer: CN=www.intel.com OU=ODCA 2 CSME ADL PTT 01SVN

The TPM appears to be functioning correctly, the EK certificate is present and can be installed locally, and Windows reports the device is capable of attestation.

This makes me suspect the failure is occurring during Microsoft's server-side validation of the Intel EK certificate chain, possibly because the Intel ODCA 2 CSME issuing CA has not yet been onboarded or trusted by the AIK enrollment service.

If Microsoft could confirm whether this certificate chain is expected to be trusted, or whether onboarding of the Intel ODCA 2 CSME CA is still in progress, that would be greatly appreciated.

Request to onboard Intel ODCA 2 CSME EK Certificate Chain of i9‑13900HX to Azure Attestation Trust List, AIK Enrollment HTTP 400 Failure

Your answer