| Previous | Next |
| STATUS_PCP_KEY_NOT_AIK | STATUS_PCP_LOCKED_OUT |
STATUS_PCP_KEY_NOT_SIGNING_KEY
The selected TPM-backed key does not have the required signing role
STATUS_PCP_KEY_NOT_SIGNING_KEY means PCP was asked to use a key for signing although the key is not configured or eligible for that role. This is not a generic cryptographic failure: encryption, key-exchange, attestation, and signing scenarios impose different requirements on key material and provider policy.
The right diagnostic is key intent. A valid TPM key may still be the wrong key for a certificate request, attestation statement, or application signature because its algorithm, usage policy, or created role does not permit signing.
What to check
- Log the requested operation, algorithm, padding or signature parameters, and the properties of the selected key.
- Verify that enrollment or provisioning selected a signing-capable template and provider configuration.
- Do not attempt to convert an existing protected key in place if its creation policy is immutable; use documented rotation or re-enrollment instead.
References
- Microsoft: PCP and TPM error codes
- Microsoft: NCryptCreatePersistedKey
- Microsoft: CNG Key Storage Providers
Looking for a different code? Search another status or error code.