| Previous | Next |
| CERTSRV_E_KEY_ATTESTATION | CERTSRV_E_EXPIRED_CHALLENGE |
CERTSRV_E_CORRUPT_KEY_ATTESTATION
The request key and attested key do not match
CERTSRV_E_CORRUPT_KEY_ATTESTATION means AD CS found that the public key in the certificate request is not consistent with the key represented by the attestation data. The CA cannot issue a certificate asserting hardware protection when the evidence belongs to a different key.
This mismatch can result from reusing an old attestation blob, rebuilding a PKCS #10 request around another public key, mixing output from parallel enrollment operations, or altering provider-specific attributes after the TPM or KSP generated them. A valid outer request signature does not repair the broken binding.
Corrective actions
- Generate the key and its attestation statement in one enrollment operation.
- Do not cache attestation attributes independently from the key container.
- Confirm that asynchronous enrollment responses are matched to the original request.
- Discard the inconsistent request and create fresh evidence rather than editing its DER.
References
- Microsoft MS-WCCE: new request with key-attestation statement
- Microsoft MS-WCCE: KeyAttestationStatement fields
- Microsoft MS-WCCE: initial attestation processing
Looking for a different code? Search another status or error code.