| Previous | Next |
| CERTSRV_E_INVALID_ATTESTATION | CERTSRV_E_CORRUPT_KEY_ATTESTATION |
CERTSRV_E_KEY_ATTESTATION
Required attestation was not achieved
CERTSRV_E_KEY_ATTESTATION is a policy result: the certificate template requires key attestation, but the CA could not complete any acceptable attestation path. This can happen even when request signing and ordinary enrollment permissions are valid.
Template flags distinguish required attestation from preferred attestation. They also select how the endorsement key is trusted, such as EK certificate validation, a configured EK public-key list, or credential-based trust. A client that omits attestation attributes or uses a software provider cannot satisfy a template requiring proof of hardware key protection.
What to compare
- Read the template's attestation-required/preferred and EK-validation flags.
- Verify that the selected KSP supports creating attested hardware keys.
- Check whether the CA supports the template and attestation version.
- Do not weaken the template until the intended assurance requirement is understood.
References
- Microsoft MS-WCCE: msPKI-Private-Key-Flag processing
- Microsoft MS-WCCE: certificate request with key attestation
- TCG: EK Credential Profile for TPM 2.0
Looking for a different code? Search another status or error code.