| Previous | Next |
| CERTSRV_E_CORRUPT_KEY_ATTESTATION | CERTSRV_E_INVALID_RESPONSE |
CERTSRV_E_EXPIRED_CHALLENGE
The challenge depends on the CA exchange certificate
CERTSRV_E_EXPIRED_CHALLENGE appears in the challenge-response form of key attestation. The CA encrypts challenge state using a current CA exchange certificate and stores request state while the client proves possession associated with the endorsement key. The later response cannot be validated if that certificate expired or its private key is no longer accessible.
Submitting the response again does not restore a missing private key. The response is tied to the original challenge and request record, so creating an unrelated challenge or rotating certificates without preserving the required decryption key can invalidate pending enrollments.
What to check
- Inspect the CA exchange certificate validity period and private-key availability.
- Confirm the pending request still contains its stored challenge state.
- Check whether certificate renewal, key migration, or backup restore occurred between request and response.
- Start a new enrollment after the CA exchange path is repaired instead of replaying stale challenge data.
References
- Microsoft MS-WCCE: generating a key-attestation challenge
- Microsoft MS-WCCE: client processing of a CA challenge
- Microsoft MS-WCCE: key attestation overview
Looking for a different code? Search another status or error code.