Hello Carl,
I have continued investigating the AIK enrollment failure on my ASUS ROG Strix G16 G614FR (AMD Ryzen 9 9955HX3D, BIOS 317, Windows 11 26H2, AMD Pluton TPM firmware 6.4.1.400). I have completed the additional checks you requested and uncovered some important findings:
1. AIK enrollment failure
certreq -enrollaik -f -machine -config "" ActivisionAIK fails with HRESULT 0x80190194 (HTTP 404).
The SCEP endpoint returns: "authority does not exist."
KeyID: 144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2.
DNS resolution and TCP connectivity to the endpoint work correctly.
2. Checks completed as requested
Following your instructions, I extracted the TPM Endorsement Key certificate and its issuer/intermediate certificates directly from my device using Get-TpmEndorsementKeyInfo.
I exported the original EK certificate and verified its SHA-256 public key hash.
I extracted and provided the certificates through the OneDrive link I previously shared.
I imported the three verified Pluton CA certificates into the Windows Local Computer certificate stores, as requested.
I also verified the AMD Device EK ICA certificate against its published AIA URL.
3. Important certificate findings
EK-Issuer SHA-1: E46F63E902D54D7498A2A8F98413472DEA49B47D
EK-Issuer AKI: 144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2
AMD Device ICA SHA-1: 01D879EF9C9AB711F8A2D572CA158E4F568DDCE1
Device ICA SKI: c1a8b8607b6967be3f1d79dc1ece94953b159cd7
The EK-Issuer AKI does not match the Device ICA SKI. Windows therefore reports 0x80096004 – TRUST_E_CERT_SIGNATURE when verifying this certificate chain. I also downloaded AMD's FIPS ICA variant. Its certificate chain verifies successfully, but it belongs to a different CA and does not match the AKI required by my Device EK-Issuer certificate.
4. TPM verification
TPM is present, ready, enabled and activated.
EK PublicKeyHash (SHA-256): 50b7b01ec80b664e892ac383baaa795e012f4216b1bee9e3b781e849d33a2b66.
The EK certificate's AKI matches the SKI of the EK-Issuer certificate.
GetWindowsAIKPlatformClaim succeeds, but GetWindowsAIKCert fails with 0x80090011.
The AIK key exists in the Microsoft Platform Crypto Provider, but its certificate is never issued.
5. Additional troubleshooting
I have already run the ASUS diagnostic and enrollment tools provided by support, without resolving the issue. Secure Boot, TPM 2.0 and Memory Integrity are enabled and working. The relevant certificate stores have also been checked for alternative Device EK ICA certificates; no alternative issuer certificate was found. I have also found reports from other ASUS G614FR users with BIOS 317 experiencing the same HTTP 404 and the same KeyID.
Could you please escalate this directly to the Microsoft team responsible for AIK/Pluton attestation and investigate the following?
Is KeyID 144be51b3e5b84380fcea2e3a3221fb7b1bdcaf2 correctly registered and mapped to an active AIK SCEP authority?
Is the AMD Device EK ICA / EK-Issuer chain correctly registered in Microsoft's attestation infrastructure?
Could the HTTP 404 be caused by a missing or incorrect backend authority mapping?
Can the responsible team verify the EK certificate and its issuer association directly on the server side?
I have completed the requested local checks and provided the certificates. At this point, I believe direct investigation of the Microsoft backend is necessary to determine why the AIK certificate cannot be issued. I can provide all original certificates, SHA-256 hashes and complete PowerShell verification logs again if required. Thank you for your continued assistance!!