| Previous | Next |
| CERTSRV_E_INVALID_EK | CERTSRV_E_INVALID_ATTESTATION |
CERTSRV_E_INVALID_IDBINDING
The identity binding proves more than key possession
CERTSRV_E_INVALID_IDBINDING means the certification authority could not validate the ID binding carried in the key-attestation statement. The binding is TPM-generated evidence associated with the attestation identity key; it connects key material and attributes to a TPM operation rather than merely showing that the client can sign arbitrary data.
A structurally valid PKCS #10 signature is therefore not enough. The CA also evaluates the CSP/KSP-specific attestation statement and the relationship among the ID binding, AIK information, hardware key information, and public key in the certificate request.
Useful evidence
- Preserve the exact
idBindingbytes from the original request. - Confirm that the request was not rebuilt after the TPM produced the binding.
- Check that the expected KSP created both the key and attestation statement.
- Verify TPM algorithm and key attributes supported by the CA's attestation implementation.
References
- Microsoft MS-WCCE: KeyAttestationStatement structure
- Microsoft MS-WCCE: initial key-attestation processing
- Microsoft MS-WCCE: certificate request with key attestation
Looking for a different code? Search another status or error code.