HRESULT 0x80094818 (CERTSRV_E_INVALID

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

AD CS could not validate the TPM identity binding associated with the request.

Previous	Next
CERTSRV_E_INVALID_EK	CERTSRV_E_INVALID_ATTESTATION

CERTSRV_E_INVALID_IDBINDING

The identity binding proves more than key possession

CERTSRV_E_INVALID_IDBINDING means the certification authority could not validate the ID binding carried in the key-attestation statement. The binding is TPM-generated evidence associated with the attestation identity key; it connects key material and attributes to a TPM operation rather than merely showing that the client can sign arbitrary data.

A structurally valid PKCS #10 signature is therefore not enough. The CA also evaluates the CSP/KSP-specific attestation statement and the relationship among the ID binding, AIK information, hardware key information, and public key in the certificate request.

Useful evidence

Preserve the exact idBinding bytes from the original request.
Confirm that the request was not rebuilt after the TPM produced the binding.
Check that the expected KSP created both the key and attestation statement.
Verify TPM algorithm and key attributes supported by the CA's attestation implementation.

References

Looking for a different code? Search another status or error code.