| Previous | Next |
| STATUS_PCP_KEY_NOT_AUTHENTICATED | STATUS_PCP_KEY_NOT_SIGNING_KEY |
STATUS_PCP_KEY_NOT_AIK
A generic TPM key cannot satisfy an AIK-specific attestation request
STATUS_PCP_KEY_NOT_AIK means the operation requires an Attestation Identity Key (AIK) role, but the key supplied does not have that role. A key can be TPM-backed and able to sign while still being unsuitable for the attestation evidence expected by the caller or relying party.
This distinction is important during certificate enrollment. TPM key attestation is a proof about protected key material and trusted TPM identity; the flow relies on compatible provider behavior and attestation evidence, not just a random signing key.
What to check
- Confirm the expected key role before selecting a key handle or persisted key name.
- Check the certificate template or verifier policy for TPM attestation requirements and the supported provider/key type.
- Do not relabel or reuse an arbitrary signing key as an AIK; create or enroll the required attestation identity through the supported workflow.
References
- Microsoft: PCP and TPM error codes
- Microsoft: TPM key attestation
- Trusted Computing Group: TPM 2.0 Library Specification
Looking for a different code? Search another status or error code.