Intel PTT TPM 2.0 AIK Certificate Enrollment Fails with HTTP 400 Call of Duty Secure Attestation

Cristian Beltran 0 Reputation points
2026-10-20T13:58:26.85+00:00

Hello,

I am experiencing an issue with TPM attestation on Windows 11 that prevents Call of Duty: Warzone from completing its security verification.

The Call of Duty Secure Attestation Wizard reports that my PC meets both TPM 2.0 and Secure Boot requirements. However, it fails when attempting to generate a new key and displays the following message:

“New key failed to be generated BIOS firmware update recommended.”

My BIOS is already updated to the latest version available for my motherboard.

Questions

Why does Microsoft's AIK certificate enrollment service reject the TPM identity request with “No valid TPM EK/Platform certificate provided” when Windows detects the TPM, reports that it is ready for attestation, and returns a manufacturer certificate through Get-TpmEndorsementKeyInfo?

Could this indicate an issue with the Intel PTT endorsement key certificate, the Intel Management Engine firmware, or Microsoft's AIK certificate enrollment service?

Is there a supported way to refresh or repair the TPM endorsement key certificate or AIK enrollment without clearing the TPM?

Could the RestartPending: True state or the Binding Not Possible PCR7 result be related to this failure?

Could having a Linux dual-boot configuration with Limine and multiple UEFI boot entries affect AIK enrollment, even though Windows reports Secure Boot as enabled and meets the Call of Duty Secure Boot requirements?

I would appreciate guidance on how to identify the root cause and resolve the AIK certificate enrollment failure without clearing the TPM, deleting Secure Boot keys, or risking access to my Windows installation.

Thank you.

Windows for home | Windows 11 | Licensing and activation
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  2. Emma1-N 14,890 Reputation points Microsoft External Staff Moderator
    2026-10-21T00:03:11.4466667+00:00

    Welcome Cristian Beltran,

    Thank you for providing the detailed information. Since Windows recognizes the TPM and Get-TpmEndorsementKeyInfo returns manufacturer certificate information, I would avoid clearing the TPM or modifying the Secure Boot keys at this stage.

    Microsoft documents that TPM attestation establishes trust starting with the TPM's Endorsement Key (EK). The presence of an EK or EK certificate by itself does not necessarily establish that an attestation request will be accepted, because the certificate/key must also satisfy the trust validation performed during attestation.

    To narrow this down, could you please confirm:

    Is this a personally owned Windows 11 PC using a personal Microsoft account, rather than a work/school or organization-managed device?

    What motherboard/system model and Intel processor are you using, and what BIOS/UEFI version is currently installed?

    1. Press Windows + R, enter tpm.msc, and confirm:
      • Status
      • Specification Version
      • Manufacturer Name
      • Manufacturer Version
    2. Open Windows Security > Device security > Security processor details and let me know whether Windows reports any warning there.

    Regarding your other questions, I would not conclude from the information currently available that Intel PTT, Intel ME firmware, Microsoft's enrollment service, PCR7, or the Linux dual-boot configuration is specifically responsible. Those possibilities would need additional diagnostic information before the cause can be isolated.

    For now, please do not clear the TPM or reset/delete Secure Boot keys. Clearing a TPM can affect keys protected by it, and Microsoft specifically recommends backing up your data before clearing a TPM.

    Once you provide the information above, I can narrow down whether Windows itself detects a TPM/firmware problem or whether the failure occurs only during the game's attestation process.

    References:

    TPM attestation overview: Trusted Platform Module attestation

    Get-TpmEndorsementKeyInfo: Get-TpmEndorsementKeyInfo

    Microsoft Support – What’s a Trusted Platform Module (TPM)?: What's a Trusted Platform Module (TPM)?

    Looking forward to your update.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.