Intel PTT AIK enrollment fails with HTTP 404 – Microsoft AIK authority does not exist

Hello,

I am experiencing a reproducible Windows TPM 2.0 / AIK attestation issue with an Intel PTT TPM.

The TPM itself appears to be fully functional:

• TPM 2.0 is present
• Manufacturer: INTC
• TPM model: TGL
• TPM firmware: 600.7.0.0
• Get-Tpm reports TpmPresent=True, TpmReady=True, TpmEnabled=True and TpmActivated=True
• IsReadyInformation returns IsReady=True, Information=0, ReturnValue=0
• Secure Boot is enabled (Confirm-SecureBootUEFI returns True)
• The TPM Endorsement Key certificate is present
• The Intel EK certificate chain is present

However, Windows does not have an AIK certificate.

Running:

TPMDiagnostics.exe GetWindowsAIKCert

returns:

No Windows AIK Cert is installed. HR: 0x80090011

I also manually started the Windows scheduled task:

\Microsoft\Windows\CertificateServicesClient\AikCertEnrollTask

but no AIK certificate was created.

The problem can be reproduced directly using the Windows built-in certreq tool:

certreq -enrollaik -config ""

Windows derives the following Microsoft AIK endpoint:

https://INTC-KeyId-3b31cad5c34b92d748c8fd92aa75ae9d324a0642.microsoftaik.azure.net/templates/Aik/scep

The request fails immediately during GetCACaps, before certificate enrollment takes place:

GetCACaps: Not Found

HTTP/1.1 404 Not Found

Server response:

The authority "intc-keyid-3b31cad5c34b92d748c8fd92aa75ae9d324a0642.microsoftaik.azure.net" does not exist.

Final error:

0x80190194 (HTTP_E_STATUS_NOT_FOUND)

The Intel EK certificate chain reported by TPMDiagnostics contains:

CSME TGL PTT 01SDE CSME TGL SVN01 Kernel DE CSME TGL ROM DE CN=www.intel.com, OU=On Die CSME D_TGL DEBUG000 Issuing CA

KeyId:

[PII removed]

A recent failed enrollment returned this Microsoft request ID:

x-ms-request-id:

[PII removed]

Microsoft Consumer Support has already reviewed the diagnostics and stated that this appears to concern the Windows TPM attestation infrastructure / AIK certificate enrollment service and would require investigation by the appropriate engineering team.

My questions are:

1. Why does the Microsoft AIK service report that this Intel KeyId authority does not exist?
2. Is the Intel D_TGL DEBUG000 Issuing CA supported by the Microsoft AIK/TPM attestation infrastructure?
3. Can this KeyId/CA be checked for proper provisioning/onboarding in the Microsoft AIK service?
4. Is there any client-side remediation possible when GetCACaps itself returns HTTP 404?

Since the failure occurs at the Microsoft AIK endpoint during GetCACaps, resetting or reprovisioning the local TPM does not appear to address the missing server-side authority.

Any guidance from the Windows TPM/Attestation team would be greatly appreciated.