AIK enrollment fails with 0x80070490 and AIK SCEP endpoint returns HTTP 404 for AMD fTPM 3.92.0.5

I had the similar problem on Lenovo Legion 5 17ACH6H (AMD Ryzen, Windows 11) and I finally managed to fix my Call of Duty TPM attestation issue. I'm sharing the full troubleshooting process because I found several similar reports, but none of the suggested solutions covered this particular issue.

My system

Laptop: Lenovo Legion 5 17ACH6H

CPU: AMD Ryzen

TPM: AMD fTPM 2.0

Initial fTPM firmware: 3.92.0.5

Updated fTPM firmware: 3.92.2.5

BIOS: HHCN38WW

OS: Windows 11

1. First problem: outdated fTPM firmware

Initially, my laptop had fTPM firmware version 3.92.0.5.

Call of Duty reported a BIOS/TPM security attestation problem.

I found a Reddit post explaining how to update the BIOS for this Lenovo model and followed those instructions. After updating the BIOS, my fTPM firmware version changed to 3.92.2.5.

This fixed the initial TPM/Secure Boot compatibility check: Windows and Call of Duty Secure Attestation Wizard recognized TPM 2.0, TPM was ready, and Secure Boot was enabled.

However, Call of Duty still couldn't complete the security attestation with error on key generation.

2. Second problem: AIK enrollment failed with 0x80070490

I tried numerous suggestions from Reddit and other discussions, including:

Clear-TPM

Initialize-TPM

Removing TPM-related registry entries

• Clearing/resetting Secure Boot keys in BIOS

Other TPM reset and initialization procedures

None of these solved the AIK enrollment problem.

Running the following command as administrator:

certreq -enrollaik -config ""

returned:

0x80070490 (WIN32: 1168 ERROR_NOT_FOUND)

The Windows Application log showed CertEnroll Event ID 86 and an HTTP 404 error from Microsoft's SCEP endpoint.

SCEP URL before the fix

https://AMD-KeyId-52fb59e29aa83a962fb9eef0fe5b4811de6b751e.microsoftaik.azure.net/templates/Aik/scep

The server returned:

HTTP/1.1 404 Not Found
The authority does not exist.

3. Finding the actual problem: Windows did not recognize the EK certificate

I started investigating the Endorsement Key (EK) certificate.

Running:

Get-TpmEndorsementKeyInfo -HashAlgorithm Sha256

showed:

IsPresent: True
ManufacturerCertificates: {}
AdditionalCertificates: {}

And:

TpmDiagnostics.exe CheckEkCertState

returned:

EKCertState is NotPresent

This was the key finding.

The TPM itself was present and working, but Windows did not recognize/register its AMD EK certificate.

I also checked the AMD EK certificate retrieval URLs using:

TpmDiagnostics.exe EKURL

The tool returned these URLs:

RSA EK certificate:

https://ftpm.amd.com/pki/aia/c873027aa8ecdc47e24519ec44b486843efb6ef55ad75716fb8e59ee598b1fc2

ECC EK certificate:

https://ftpm.amd.com/pki/aia/4af48309c4cfced5de78c90f76b2d22bd16f8467d9eb5a3b6cd47eb892b46a5d

I successfully downloaded both certificates using:

TpmDiagnostics.exe GetEkCertFromWeb rsa-ek.cer
TpmDiagnostics.exe GetEkCertFromWeb -ecc ecc-ek.cer

The RSA certificate's public key hash matched the TPM's EK public key hash.

4. The actual fix: InstallEkCertThroughCoreProv

I checked the available TpmDiagnostics commands and found:

TpmDiagnostics.exe InstallEkCertThroughCoreProv

I ran it as administrator.

Result:

Successfully retrieved EK Certificate

Then I checked the certificate state again:

TpmDiagnostics.exe CheckEkCertState

Result:

EKCertState is Present

Running Get-TpmEndorsementKeyInfo now showed the AMD EK certificate under AdditionalCertificates.

Interestingly, ManufacturerCertificates was still empty. This did NOT prevent successful AIK enrollment or Call of Duty attestation.

5. AIK enrollment finally succeeded

I ran the original command again:

certreq -enrollaik -config ""

This time, Windows used a different AMD KeyId and a different Microsoft SCEP endpoint.

SCEP URL after the fix

https://AMD-KeyId-1b3648db23e5e6a3972b8c920328b6e4aa9a7c3d.microsoftaik.azure.net/templates/Aik/scep

The server returned HTTP 200 OK.

The enrollment result was:

PkiStatus(0): SCEPDispositionSuccess
EnrollStatus(1): Enrolled
Operation completed successfully. 0x0
EnrollDone
Submit(ChallengeAnswer): OK

Microsoft successfully issued a new AIK certificate.

6. Final result

I launched Call of Duty again, and the TPM/security attestation check finally passed!

No Windows reinstall was needed. No TPM replacement was needed.

My conclusions

I suspect there were two separate issues:

The original fTPM firmware version 3.92.0.5 needed a BIOS/firmware update to 3.92.2.5 to resolve the initial Call of Duty TPM/Secure Boot compatibility problem.

After the BIOS update, Windows still did not recognize/register the AMD EK certificate. This caused AIK enrollment to use an unavailable Microsoft SCEP authority, resulting in HTTP 404.

I cannot prove that the BIOS update itself caused the EK certificate registration problem. It is possible that Windows failed to discover or register the certificate for another reason.

The important discovery was that installing the EK certificate through Core Provisioning changed the EK state from NotPresent to Present, and the next AIK enrollment attempt succeeded using a different KeyId and SCEP URL.

Suggested solution for people with the same symptoms

If your TPM is ready, Secure Boot is enabled, but certreq -enrollaik fails with 0x80070490 and the SCEP endpoint returns HTTP 404, check the EK certificate state first.

If it reports NotPresent, try:

TpmDiagnostics.exe InstallEkCertThroughCoreProv
TpmDiagnostics.exe CheckEkCertState
certreq -enrollaik -config ""

Important: I would try this before clearing the TPM, deleting registry keys, resetting BIOS security keys, or reinstalling Windows. In my case, those reset attempts were unnecessary.

Hopefully this helps other AMD fTPM / Lenovo Legion owners experiencing the same problem!

Hello User-20YM,

Welcome to Microsoft Q&A forum.

You're not alone in this. I've seen multiple users reporting this issue. Also, there are a few entries for this in the Feedback Hub, you can submit your issue there as well to inform the engineering team.

In the meantime, you can try this method to see if it helps.

• Extract and verify the following three intermediate CA certificates directly from TPM firmware:
  • CSME ADL ROM CA
  • CSME ADL SVN01 Kernel CA
  • CSME ADL PTT 01SVN
• Import those three verified certificates into the Windows Local Computer > Intermediate Certification Authorities certificate store.

---

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.