What does NTSTATUS 0xC0290053 (STATUS_TPM_DAA_ISSUER_SETTINGS) mean?

STATUS_TPM_DAA_ISSUER_SETTINGS

The TPM rejected the DAA issuer settings

STATUS_TPM_DAA_ISSUER_SETTINGS means the TPM rejected the issuer-side settings used by a Direct Anonymous Attestation operation. DAA depends on issuer-provided public parameters as well as TPM-held state, so issuer material must be internally consistent and appropriate for the current stage.

This is different from a general certificate-chain failure. The TPM is not merely saying that an external identity is untrusted; it is rejecting the DAA issuer settings as inconsistent for the command.

Preserve the exact issuer-settings blob and the DAA command stage. Without that, later logs tend to collapse this into an unhelpful “attestation failed” message.

Diagnostic focus

• Keep the issuer-settings blob with the failing command trace.
• Verify that the issuer settings correspond to the same DAA parameters used for the join/sign flow.
• Check for endian, length, or structure-version mismatches in the caller-side TPM library.

References

• TCG: TPM 1.2 Main Specification
• TCG: TPM 1.2 Part 1 Design Principles
• TCG: TPM 1.2 Part 2 Structures of the TPM
• TCG: TPM 1.2 Part 3 Commands
• Microsoft: TPM Base Services
• Microsoft: MS-ERREF NTSTATUS values