Intel PTT AIK enrollment fails — GetCACaps HTTP 404, authority does not exist

Question

Intel PTT AIK enrollment fails — GetCACaps HTTP 404, authority does not exist

Agustin ♠ fonseca 0

Hello Microsoft Support Team,

I am reporting a persistent AIK (Attestation Identity Key) certificate enrollment failure involving Intel Platform Trust Technology (PTT) and Microsoft AIK Cloud CA.

My TPM passes the local pre-attestation health checks, but the Microsoft AIK enrollment service returns HTTP 404 — The authority does not exist during the GetCACaps stage.

I would appreciate assistance determining why the corresponding Intel PTT certification authority is not being recognized by the Microsoft AIK service.

1. System Information

Operating System: Windows 11 Pro, build 28000.1

Motherboard: ASUS ROG STRIX B660-A GAMING WIFI D4

BIOS Version: 4003

Processor: Intel Core i7-12700

TPM: Intel PTT, TPM 2.0

TPM Firmware: 600.18.1040.2765

EK Certificate Issuer: CSME ADL PTT 01SVN

Secure Boot: Enabled

2. Exact AIK Enrollment Error

Failed operation: GetCACaps

HTTP Status: 404 Not Found

Error Code: 0x80190194

Enrollment Stage: 140

Microsoft AIK Authority:

intc-keyid-6b0ea536ad1300554a87b1b814c6df955de6b46d.microsoftaik.azure.net

Server Error Message:

Ruby

GetCACaps: Not Found

The authority
"intc-keyid-6b0ea536ad1300554a87b1b814c6df955de6b46d.microsoftaik.azure.net"
does not exist.

HTTP/1.1 404 Not Found
0x80190194

Microsoft Request ID:

7f3cc4ff-ca8e-4a13-be25-64c02f21070f

Date: November 12, 2026

The endpoint is reachable through DNS and HTTPS. The server returns an application-level HTTP 404 response rather than a connection timeout.

3. TPM Pre-Attestation Results

Windows TPM-WMI Event ID 1041 reports:

HealthStatus: Attestable

The following checks passed:


Check	Result

Check	Result
TpmPresent	True
TpmMeetsMinimumVersion	True
TpmIsResponsive	True
EkCertIsAvailable	True
TcgLogFound	True
PcrsMatchTcgLog	True
SecureBootEnabled	True

These results show that the TPM satisfies the local pre-attestation health checks.

However, AIK certificate enrollment remains unsuccessful.

4. Additional Verification

The following checks have already been performed:

Verified TPM 2.0 detection, initialization, and responsiveness.

Confirmed that Secure Boot is enabled.

Verified that the Intel EK certificate is present and readable.

Confirmed that the EK certificate's Authority Key Identifier matches the Intel Key ID used in the AIK endpoint.

Examined the Intel endorsement certificate chain. Additional intermediate CA certificates were retrieved for local analysis, while the root was not trusted in the local Windows certificate store.

Verified successful DNS resolution and HTTPS connectivity to Microsoft's AIK service.

Confirmed that the AIK endpoint responds with HTTP 404 and an authority-not-found message.

Verified that essential cryptographic services, including CryptSvc and KeyIso, are running.

Confirmed that the AIK enrollment scheduled task and its associated Microsoft-signed components are present.

Attempted AIK enrollment through certreq -enrollaik, which separately returned 0x80070490 (Element not found).

The specific GetCACaps failure continues to indicate that the requested authority is not found by the responding service.

5. Impact

The AIK certificate enrollment failure prevents the certification stage of Call of Duty RICOCHET Secure Attestation from completing successfully.

The local TPM pre-attestation checks pass, but the required AIK certificate is not successfully issued.

6. Request for Microsoft AIK Cloud CA Investigation

Could Microsoft please clarify the following?

Is Intel PTT Key ID 6b0ea536ad1300554a87b1b814c6df955de6b46d registered in Microsoft AIK Cloud CA?

Is the corresponding authority currently active and available for AIK certificate enrollment?

Is this Intel Key ID correctly associated with the CSME ADL PTT 01SVN endorsement certificate hierarchy?

Does the HTTP 404 response indicate an authority-registration, trust-mapping, or backend configuration issue?

Is there a supported resolution for this specific authority, or does it require intervention by the Microsoft AIK service engineering team?

Could the Microsoft team investigate the provided x-ms-request-id to identify why the authority lookup failed?

I understand that the backend authority registration and mapping information is not publicly accessible and requires verification by Microsoft.

I would appreciate escalation to the engineering team responsible for Windows TPM Attestation / Microsoft AIK Cloud CA / AIK SCEP Enrollment if necessary.

Additional diagnostic logs can be provided privately upon request.

Thank you for your assistance.Hello Microsoft Support Team,

I am reporting a persistent AIK (Attestation Identity Key) certificate enrollment failure involving Intel Platform Trust Technology (PTT) and Microsoft AIK Cloud CA.

My TPM passes the local pre-attestation health checks, but the Microsoft AIK enrollment service returns HTTP 404 — The authority does not exist during the GetCACaps stage.

I would appreciate assistance determining why the corresponding Intel PTT certification authority is not being recognized by the Microsoft AIK service.

0 comments

1 answer

Your answer

Answer 1

Only Microsoft can confirm whether this private Intel authority is registered and mapped, so reproduce the enrollment on an unmodified Microsoft Windows image and, if the same GetCACaps 404 remains, escalate it with the authority name and request ID for AIK Cloud CA investigation.

What the 404 establishes

Your response is generated by the AIK service after DNS resolution and HTTPS connection:

GetCACaps
HTTP 404
The authority "intc-keyid-...microsoftaik.azure.net" does not exist
0x80190194

That is distinct from a DNS or transport failure. A matching Intel PTT report associates this exact combination—GetCACaps, HTTP 404, and “authority does not exist”—with an authority not recognized by the AIK backend.^1^

A closely matching, accepted Pluton case says end users cannot register TPM KeyIDs or modify the Microsoft AIK trust database and identifies no supported client workaround when the corresponding authority is absent.^2^ That supports escalation, but it does not independently prove the status or Intel EK mapping of your specific authority. Those records are private service state that Microsoft must inspect.

Remove the modified-image confounder

The current X-Lite installation has known component-store corruption, and build 28000.1 is from the Windows 11 26H1 build family; later 28000 builds are documented as Insider Release Preview builds.^3^ Microsoft support will reasonably require reproduction on an intact Microsoft image before treating the result as a cloud-authority defect.

Back up files and save the BitLocker recovery key, if encryption is enabled.
Install the latest official, unmodified Windows 11 image.
- A clean installation removes files, settings, and applications, so do not proceed without a backup.^4^
- Windows Setup supports both clean and upgrade installation types.^5^
Install Windows updates and ASUS/Intel firmware and drivers applicable to the board.
Re-run the AIK enrollment without importing extra EK roots or clearing the TPM.
Capture the complete event containing:
- Authority hostname
- GetCACaps
- HTTP status and 0x80190194
- x-ms-request-id
- UTC timestamp
- Windows edition, version, full build, and installation source

If an official installation returns the same authority-specific 404, the remaining evidence strongly supports a service-side recognition or mapping issue rather than the modified client image.

Escalation route and payload

For Windows 11 Home/Pro consumer support:

Open Get Help.
Search for TPM AIK certificate enrollment HTTP 404.
Select Contact Support.
Choose Windows → Security or the closest TPM/certificate category.
Request escalation for Microsoft AIK Cloud CA authority recognition/mapping.

Get Help can offer chat or callback depending on region, hours, scenario, and subscription.^6^

Include this concise escalation statement:

On an official, unmodified Windows installation, AIK SCEP enrollment reaches Microsoft AIK Cloud CA but GetCACaps returns HTTP 404 / 0x80190194: “The authority intc-keyid-6b0ea536ad1300554a87b1b814c6df955de6b46d.microsoftaik.azure.net does not exist.” Please verify that this Intel PTT KeyID authority is registered, active, and mapped to the CSME ADL PTT 01SVN endorsement hierarchy. Attached are the complete event, UTC timestamp, x-ms-request-id, EK certificate, TPM/firmware information, and Windows build.

Do not publish the EK certificate or full diagnostic bundle publicly; provide them only through the private support case.

TPM clearing

Do not clear the TPM merely for this 404. Microsoft warns that TPM wipe/reset troubleshooting can cause data loss.^7^ Clearing local TPM state cannot create a missing cloud authority record, and your TPM-ready and attestable checks have already ruled out the ordinary condition that would justify that step.

References