| Previous | Next |
| CERTSRV_E_INVALID_IDBINDING | CERTSRV_E_KEY_ATTESTATION |
CERTSRV_E_INVALID_ATTESTATION
The attestation statement failed CA validation
CERTSRV_E_INVALID_ATTESTATION is the general failure for private-key attestation data that reaches the CA but does not validate. The request can still be a correctly signed PKCS #10 object; the additional evidence intended to prove that the key is hardware protected is what failed.
Windows key attestation is provider-specific. The request contains attributes identifying the KSP and carrying hardware-key and attestation structures. A mismatched provider, unsupported statement format, altered opaque data, or failed cryptographic verification can all prevent the CA from accepting the evidence.
Diagnostic path
- Confirm the template requires or prefers attestation and supports the client version.
- Inspect the KSP name and all attestation-related request attributes.
- Compare the public key in the request with the key referenced by the attestation data.
- Review CA operational logs before retrying with a newly generated hardware key.
References
- Microsoft MS-WCCE: key attestation overview
- Microsoft MS-WCCE: initial attestation validation rules
- Microsoft: certificate request encoding
Looking for a different code? Search another status or error code.