| Previous | Next |
| CERTSRV_E_EXPIRED_CHALLENGE | CERTSRV_E_INVALID_REQUESTID |
CERTSRV_E_INVALID_RESPONSE
The response does not prove the pending challenge
CERTSRV_E_INVALID_RESPONSE is returned when AD CS cannot validate the client's response to a key-attestation challenge. The response must correspond to the pending request, recover the expected challenge secret through the TPM-backed protocol, and preserve the request identifiers and attestation context established earlier.
A response from another enrollment attempt, a duplicate response after state changed, corrupted opaque data, or a client that used the wrong endorsement key can all fail this check. Network delivery alone does not establish that the response belongs to the request being completed.
Diagnostic checks
- Correlate the response with the exact CA request ID and challenge record.
- Ensure the client retained the same TPM/KSP key context throughout the exchange.
- Check for load balancers or middleware that replayed or reordered enrollment messages.
- Generate a fresh challenge when the pending state is no longer trustworthy.
References
- Microsoft MS-WCCE: responding to a CA challenge message
- Microsoft MS-WCCE: CA challenge generation and storage
- Microsoft MS-WCCE: key-attestation request flow
Looking for a different code? Search another status or error code.