"Windows AIK Certificates not being generated - TPM attestation fails for Call of Duty (HTTP 400 Bad Request)"

Question

"Windows AIK Certificates not being generated - TPM attestation fails for Call of Duty (HTTP 400 Bad Request)"

seba bermudez 20

Hello,

I am experiencing a Windows AIK Certificate provisioning failure that is blocking TPM attestation for Call of Duty Warzone (Ricochet anti-cheat).

Background: After working with Intel Support (Case: 06910525), they resolved the Intel-side issue by reinstalling the Intel Management Engine driver. The EK Certificate is now available and stable.

Current status (from Event ID 1041):

HealthStatus: Attestable ✅
EkCertIsAvailable: true ✅
EkCertRsa2048IsAvailable: true ✅
WindowsAikCertRsa2048IsAvailable: false ❌
WindowsAikCertEccP256IsAvailable: false ❌
WindowsAikCertEccP384IsAvailable: false ❌

Exact error in Event Viewer (CertificateServicesClient-CertEnroll, Event 87): 'No valid TPM EK/Platform certificate provided in the TPM identity request message' HTTP 400 Bad Request from: INTC-KeyId-34219b21f477f6c7f78a0f26b23d0430deea4363.microsoftaik.azure.net

System:

Windows 11 Pro, Build 26200.8894
Intel Core i5-12400F
ASRock H610M-HVS/M.2 R2.0
Intel PTT TPM 2.0, firmware 600.18.30.2264
BIOS 11.01 (latest available)
Intel ME driver: 2603.9.4.0

Intel confirmed their components are working correctly and referred me to Microsoft for the Windows AIK certificate provisioning issue.

How can I resolve the Windows AIK Certificate generation failure?""Hello,

I am experiencing a Windows AIK Certificate provisioning failure that is blocking TPM attestation for Call of Duty Warzone (Ricochet anti-cheat).

Background:
After working with Intel Support (Case: 06910525), they resolved the Intel-side issue by reinstalling the Intel Management Engine driver. The EK Certificate is now available and stable.

Current status (from Event ID 1041):

HealthStatus: Attestable ✅
EkCertIsAvailable: true ✅
EkCertRsa2048IsAvailable: true ✅
WindowsAikCertRsa2048IsAvailable: false ❌
WindowsAikCertEccP256IsAvailable: false ❌
WindowsAikCertEccP384IsAvailable: false ❌

Exact error in Event Viewer (CertificateServicesClient-CertEnroll, Event 87):
'No valid TPM EK/Platform certificate provided in the TPM identity request message'
HTTP 400 Bad Request from: INTC-KeyId-34219b21f477f6c7f78a0f26b23d0430deea4363.microsoftaik.azure.net

System:

Windows 11 Pro, Build 26200.8894
Intel Core i5-12400F
ASRock H610M-HVS/M.2 R2.0
Intel PTT TPM 2.0, firmware 600.18.30.2264
BIOS 11.01 (latest available)
Intel ME driver: 2603.9.4.0

Intel confirmed their components are working correctly and referred me to Microsoft for the Windows AIK certificate provisioning issue.

How can I resolve the Windows AIK Certificate generation failure?"

0 comentarios

Respuesta aceptada por el autor de la pregunta

Carl-L 18,910 Personal externo de Microsoft Moderador

Hello seba bermudez,

Welcome to Microsoft Q&A forum.

This is the forum for es-es locale. However, I will answer you in English since the original thread is in English. If you need support using your local language, please let me know.

Before we proceed further, can you please try to run this check and quick fix to see if this helps?

Validate EK certificate chain.
- Type "PowerShell" in the search bar and select "Run as administrator".
- Type TPMDiagnostics ekchainnv and press Enter.
- Type certutil -v -store "CA" and press Enter.
- Please help looking for any error in this.
Force AIK re-enrollment.
- In the PowerShell, type certutil -deletehellocontainer and press Enter.
- When it is done, type certreq -enrollaik -config "" and press Enter.

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Carl-L 18,910 Puntos de reputación Personal externo de Microsoft Moderador

2026-08-01T09:48:45.2566667+00:00

Hello seba bermudez,

Just checking in to make sure that you have received my reply. Please let me know if you have any updates.
seba bermudez 20 Puntos de reputación

2026-08-01T16:55:17.4566667+00:00
"Hello Carl-L,

Thank you for the response. Here are the results:

Step 1 - TPMDiagnostics ekchainnv: 1 EKCert found. The chain is complete (4 elements):

id:02580012 → CSME ADL PTT 01SVN → CSME ADL SVN01 Kernel CA → CSME ADL ROM CA → Intel root

Trust dwErrorStatus: 0x10000 (chain cannot be validated against Microsoft servers)

certutil -v -store CA: Completed successfully, no errors.

Step 2:

certutil -deletehellocontainer: Error 0x80090011 NTE_NOT_FOUND (Windows Hello not configured, nothing to delete)

certreq -enrollaik: ERROR_NOT_FOUND — Azure AIK service rejects the enrollment

The EK certificate chain is complete locally but Microsoft Azure AIK cannot validate it server-side. This appears to be a missing Intel CSME ADL PTT intermediate CA in the Microsoft Azure AIK trust pool.

Is this a known issue that requires Microsoft to update the Azure AIK trust pool to include the Intel CSME ADL PTT issuing CA?""Hello Carl-L,

Thank you for the response. Here are the results:

Step 1 - TPMDiagnostics ekchainnv:
1 EKCert found. The chain is complete (4 elements):

id:02580012 → CSME ADL PTT 01SVN → CSME ADL SVN01 Kernel CA → CSME ADL ROM CA → Intel root

Trust dwErrorStatus: 0x10000 (chain cannot be validated against Microsoft servers)

certutil -v -store CA: Completed successfully, no errors.

Step 2:

certutil -deletehellocontainer: Error 0x80090011 NTE_NOT_FOUND (Windows Hello not configured, nothing to delete)

certreq -enrollaik: ERROR_NOT_FOUND — Azure AIK service rejects the enrollment

The EK certificate chain is complete locally but Microsoft Azure AIK cannot validate it server-side. This appears to be a missing Intel CSME ADL PTT intermediate CA in the Microsoft Azure AIK trust pool.

Is this a known issue that requires Microsoft to update the Azure AIK trust pool to include the Intel CSME ADL PTT issuing CA?"
seba bermudez 20 Puntos de reputación

2026-08-02T05:55:39.4866667+00:00
"Hello Carl-L,

Here are the results of the steps you suggested:

TPMDiagnostics ekchainnv: 1 EKCert found, chain complete (4 elements), dwErrorStatus: 0x10000

certutil -v -store CA: Completed successfully

certutil -deletehellocontainer: Error 0x80090011 NTE_NOT_FOUND (Windows Hello not configured)

certreq -enrollaik: ERROR_NOT_FOUND

Additionally I ran TPMDiagnostics InstallEkCertThroughCoreProv which returned 'Successfully retrieved EK Certificate', followed by certutil -pulse.

After all these steps, the WindowsAIK Certificates are still not being generated:

WindowsAikCertRsa2048IsAvailable: false

WindowsAikCertEccP256IsAvailable: false

WindowsAikCertEccP384IsAvailable: false

The EK Certificate is available and HealthStatus is Attestable, but Microsoft Azure AIK service continues to reject the enrollment with HTTP 400 'No valid TPM EK/Platform certificate provided'.

This appears to require an update to the Microsoft Azure AIK trust pool to include the Intel CSME ADL PTT issuing CA. Can this be escalated to the Microsoft TPM attestation trust team?""Hello Carl-L,

Here are the results of the steps you suggested:

TPMDiagnostics ekchainnv: 1 EKCert found, chain complete (4 elements), dwErrorStatus: 0x10000

certutil -v -store CA: Completed successfully

certutil -deletehellocontainer: Error 0x80090011 NTE_NOT_FOUND (Windows Hello not configured)

certreq -enrollaik: ERROR_NOT_FOUND

Additionally I ran TPMDiagnostics InstallEkCertThroughCoreProv which returned 'Successfully retrieved EK Certificate', followed by certutil -pulse.

After all these steps, the WindowsAIK Certificates are still not being generated:

WindowsAikCertRsa2048IsAvailable: false

WindowsAikCertEccP256IsAvailable: false

WindowsAikCertEccP384IsAvailable: false

The EK Certificate is available and HealthStatus is Attestable, but Microsoft Azure AIK service continues to reject the enrollment with HTTP 400 'No valid TPM EK/Platform certificate provided'.

This appears to require an update to the Microsoft Azure AIK trust pool to include the Intel CSME ADL PTT issuing CA. Can this be escalated to the Microsoft TPM attestation trust team?"

1 respuesta adicional

Su respuesta

Carl-L 18,910 Puntos de reputación Personal externo de Microsoft Moderador

2026-08-01T09:48:45.2566667+00:00

Hello seba bermudez,

Just checking in to make sure that you have received my reply. Please let me know if you have any updates.
seba bermudez 20 Puntos de reputación

2026-08-01T16:55:17.4566667+00:00

"Hello Carl-L,

Thank you for the response. Here are the results:

Step 1 - TPMDiagnostics ekchainnv: 1 EKCert found. The chain is complete (4 elements):

id:02580012 → CSME ADL PTT 01SVN → CSME ADL SVN01 Kernel CA → CSME ADL ROM CA → Intel root

Trust dwErrorStatus: 0x10000 (chain cannot be validated against Microsoft servers)

certutil -v -store CA: Completed successfully, no errors.

Step 2:

certutil -deletehellocontainer: Error 0x80090011 NTE_NOT_FOUND (Windows Hello not configured, nothing to delete)

certreq -enrollaik: ERROR_NOT_FOUND — Azure AIK service rejects the enrollment

The EK certificate chain is complete locally but Microsoft Azure AIK cannot validate it server-side. This appears to be a missing Intel CSME ADL PTT intermediate CA in the Microsoft Azure AIK trust pool.

Is this a known issue that requires Microsoft to update the Azure AIK trust pool to include the Intel CSME ADL PTT issuing CA?""Hello Carl-L,

Thank you for the response. Here are the results:

Step 1 - TPMDiagnostics ekchainnv:
1 EKCert found. The chain is complete (4 elements):

id:02580012 → CSME ADL PTT 01SVN → CSME ADL SVN01 Kernel CA → CSME ADL ROM CA → Intel root

Trust dwErrorStatus: 0x10000 (chain cannot be validated against Microsoft servers)

certutil -v -store CA: Completed successfully, no errors.

Step 2:

certutil -deletehellocontainer: Error 0x80090011 NTE_NOT_FOUND (Windows Hello not configured, nothing to delete)

certreq -enrollaik: ERROR_NOT_FOUND — Azure AIK service rejects the enrollment

The EK certificate chain is complete locally but Microsoft Azure AIK cannot validate it server-side. This appears to be a missing Intel CSME ADL PTT intermediate CA in the Microsoft Azure AIK trust pool.

Is this a known issue that requires Microsoft to update the Azure AIK trust pool to include the Intel CSME ADL PTT issuing CA?"

Answer 1

Deleted

Esta respuesta se ha eliminado debido a una infracción del Código de Conducta. La respuesta se informó o identificó manualmente a través de la detección automatizada antes de que se realizara la acción. Consulte nuestro Código de Conducta para obtener más información.

Los comentarios se han desactivado. Más información