| Previous | Next |
| CERTSRV_E_RENEWAL_BAD_PUBLIC_KEY | CERTSRV_E_INVALID_IDBINDING |
CERTSRV_E_INVALID_EK
The CA could not establish trust in the endorsement key
CERTSRV_E_INVALID_EK is returned during AD CS private-key attestation when the endorsement key information cannot be parsed, verified, or reconciled. Depending on certificate-template policy, the CA can validate an EK certificate, compare an EK public key with an administrator-maintained trust list, or rely on authenticated credentials.
An EK certificate and an attestation key are different objects. The EK establishes a hardware-rooted identity for the trust module; the request key being certified is bound through the attestation protocol. Importing an arbitrary public key into the request does not make it a valid EK.
What to verify
- Determine which template trust mode is selected: EK certificate, EK key list, or trust on use.
- Validate the EK certificate chain, profile, key usage, and manufacturer trust anchors.
- Confirm that encrypted hardware-key information can be decrypted by the CA.
- Compare the extracted EK public key with the certificate or configured key list.
References
- Microsoft MS-WCCE: key-attestation template flags
- Microsoft MS-WCCE: attestation based on certificates
- TCG: EK Credential Profile for TPM 2.0
Looking for a different code? Search another status or error code.