HRESULT 0x8009481B (CERTSRV_E_CORRUPT_KEY

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The request public key does not match the private-key attestation evidence.

Previous	Next
CERTSRV_E_KEY_ATTESTATION	CERTSRV_E_EXPIRED_CHALLENGE

CERTSRV_E_CORRUPT_KEY_ATTESTATION

The request key and attested key do not match

CERTSRV_E_CORRUPT_KEY_ATTESTATION means AD CS found that the public key in the certificate request is not consistent with the key represented by the attestation data. The CA cannot issue a certificate asserting hardware protection when the evidence belongs to a different key.

This mismatch can result from reusing an old attestation blob, rebuilding a PKCS #10 request around another public key, mixing output from parallel enrollment operations, or altering provider-specific attributes after the TPM or KSP generated them. A valid outer request signature does not repair the broken binding.

Corrective actions

Generate the key and its attestation statement in one enrollment operation.
Do not cache attestation attributes independently from the key container.
Confirm that asynchronous enrollment responses are matched to the original request.
Discard the inconsistent request and create fresh evidence rather than editing its DER.

References

Looking for a different code? Search another status or error code.