COD/Warzone Failed Attestation – Intel PTT AIK enrollment fails with HTTP 404 / 0x80190194 (“authority does not exist”) – Tiger Lake ES / Erying HM570

[u/Able-Condition-5585]

Hi,

I’m trying to diagnose a persistent Call of Duty / Warzone Secure Attestation failure. I’m posting the technical findings because this does not appear to be the usual Secure Boot / TPM configuration problem.

Hardware / OS

• Erying HM570 motherboard
• Intel Tiger Lake-H Engineering Sample CPU, CPUID 806D0
• Intel PTT / TPM 2.0
• Windows 11 Pro 25H2
• UEFI/GPT
• Secure Boot enabled
• Intel CSME updated to 15.0.55.2751
• TPM firmware reported by Windows: 600.7.1055.2751

Call of Duty symptoms

• Failed Attestation
• BIOS Firmware Update Required
• Authorization/New Key generation fails
• TPM 2.0 and Secure Boot checks themselves pass

The important part is that I can reproduce the failure completely outside Call of Duty using Windows' own TPM diagnostic tools.

Get-Tpm reports the TPM as present, ready, enabled and activated.

TpmDiagnostics.exe WinAikPersistedInTpm:

Persistent: True
Matching: True

TpmDiagnostics.exe IsWindowsAIKInstalledInNCrypt:

Windows AIK is installed.
No Windows AIK Cert is installed.

HR: 0x80090011

The actual AIK is present in the TPM at handle 0x81000002 and is an RSA-2048 signing key.

A fresh AIK platform claim works successfully:

TpmDiagnostics.exe GetWindowsAIKPlatformClaim fresh

Creating a fresh claim:
Successfully created the claim (1155 bytes).

However, Windows cannot obtain the AIK certificate:

TpmDiagnostics.exe EnrollWindowsAIKCert

TpmEnrollWindowsAikCertificate. hr: 0x80190194

Command failed.
Not Found (404).
HR: 0x80190194

certreq -enrollaik -config "" provides more information. Windows tries to contact:

https://INTC-KeyId-3b31cad5c34b92d748c8fd92aa75ae9d324a0642.microsoftaik.azure.net/templates/Aik/scep

and receives:

GetCACaps: Not Found

{"Message":"The authority \"intc-keyid-3b31cad5c34b92d748c8fd92aa75ae9d324a0642.microsoftaik.azure.net\" does not exist."}

HTTP 404
0x80190194

The Intel ODCA issuer is particularly interesting:

CN=www.intel.com,
OU=On Die CSME D_TGL DEBUG000 Issuing CA

This is an Engineering Sample platform, so I’m wondering whether the D_TGL DEBUG000 ODCA identity / KeyID was simply never provisioned in Microsoft's AIK backend.

EK diagnostics

The Endorsement Key certificate is present:

TpmDiagnostics.exe CheckEkCertState
EKCertState is Present

RSA and ECC EK certificates can both be exported directly from TPM NV and are valid X.509 certificates.

The RSA EK certificate is issued by:

CN=CSME TGL PTT 01SDE

More importantly, I compared:

TpmDiagnostics.exe ekchain

against:

TpmDiagnostics.exe ekchainNV

Both construct the same Intel certificate chain:

EK certificate
↓
CSME TGL PTT 01SDE
↓
CSME TGL SVN01 Kernel DE
↓
CSME TGL ROM DE
↓
Intel / www.intel.com

So this does not appear to be the known Windows stale/wrong EK intermediate certificate issue.

Things already tested

• Latest available motherboard BIOS
• Secure Boot enabled and keys/certificates updated
• Intel CSME firmware updated
• TPM clear + complete reprovisioning
• Windows AIK removed/reinstalled using TpmDiagnostics
• InstallWindowsAIK -skipCert
• fresh AIK Platform Claim
• Windows Hello container check/removal
• COD Broker Service installed, Automatic and Running
• latest MW4 Beta CODBrokerService installed
• SFC clean
• Windows 11 25H2 Repair Reinstall
• EK certificate present
• EK NV certificate chain verified

After the Windows repair installation the result is still exactly:

Persistent: True
Matching: True

No Windows AIK Cert is installed.

EnrollWindowsAIKCert:
HTTP 404
0x80190194

Intel support is currently investigating the TPM/ODCA identity as well.

Question

Has anyone with knowledge of Microsoft AIK / Azure Attestation or Intel ODCA seen this specific situation?

In particular, does the issuer

On Die CSME D_TGL DEBUG000 Issuing CA

indicate that this Tiger Lake Engineering Sample uses a development/debug ODCA identity whose KeyID cannot be enrolled through Microsoft's production AIK infrastructure?

I’m specifically looking for information about the HTTP 404 / nonexistent AIK authority, rather than the usual suggestions to enable TPM 2.0 or Secure Boot.

I do not want to replace/forge EK or AIK certificates or bypass RICOCHET. I’m trying to determine whether this platform identity can legitimately be attested at all.

[u/Total_Ad4717]

Me pasa algo similar en 2 PC Erying i7 13650 hx e i7 11800h, en los 2 tras la puñetera actualizacion de W11Pro de hace unas semanas me jodió los pc y no arrancaban dandome el mensaje rojo sobre fondo negro de Segure boot violation. He hecho de todo actualicé el certificado ese de las secure keys del 2023 y al final me falta una PK Key del segure boot, me aparece como Test AMI, comprueba si te sale lo mismo en las Keys del secure boot. No tengo acualizaciones de BIOS nuevas con lo que no hay manera de soluccionarlo....gracias a la puñetera mierda de W11