Call of Duty Secure Attestation fails — Intel PTT AIK enrollment HTTP 400

The supported next action is to update the ASUS BIOS and Intel ME/CSME firmware, ensure Intel’s EK certificate service is reachable, and then escalate the unchanged HTTP 400 with the EK certificate and enrollment logs because Microsoft does not document a local method to repair or override a rejected AIK trust chain.

The available evidence does not confirm whether the specific Intel PTT endorsement chain on BIOS 1836 is currently accepted by Microsoft’s AIK service. The exact matching Microsoft Q&A reports have no accepted or recommended resolution, while similar Intel reports describe the same Call of Duty, Intel PTT, HTTP 400, and 0x80190190 combination.^1^^2^

1. Update the platform provisioning components

From the ASUS support page for the exact PRIME Z790-P WIFI board revision:

1. Compare BIOS 1836 with the latest stable BIOS offered for that exact model.
2. Install the latest applicable:
   • BIOS/UEFI
   • Intel Management Engine/CSME firmware
   • Intel chipset and ME interface packages
3. Install all current Windows cumulative updates.
4. Restart, then retry Call of Duty Secure Attestation and inspect the new CertEnroll event.

Firmware updates are the relevant supported remediation because firmware TPM certificates can be provisioned through the manufacturer’s online service, and Microsoft’s attestation guidance identifies firmware updates as necessary where a TPM cannot be attested.^3^^4^

2. Check Intel EK certificate provisioning connectivity

Intel firmware TPM devices obtain a signed endorsement certificate online. If outbound traffic is filtered by DNS security, a firewall, proxy, or TLS inspection, allow direct HTTPS access to:

https://ekop.intel.com/ekcertservice

Microsoft documents this endpoint specifically for Intel firmware TPM endorsement-certificate provisioning.^3^

An EK certificate being present does not by itself prove that the remote service can build and trust its complete chain. Chain validation also checks signatures, expiration, revocation, and applicable certificate policies.^5^ However, an empty AdditionalCertificates field alone is not documented as proof that an intermediate certificate is missing, and there is no documented supported procedure to insert certificates into the request manually.

3. Collect the EK certificate for escalation

Run elevated PowerShell and export the manufacturer certificate:

$ek = Get-TpmEndorsementKeyInfo
$ek | Format-List *
$ek.ManufacturerCertificates |
    Export-Certificate -FilePath "$env:USERPROFILE\Desktop\EkCert.cer"

Get-TpmEndorsementKeyInfo is Microsoft’s documented method for extracting the EK certificate for attestation troubleshooting.^6^

Provide ASUS/Intel support with:

• Exact motherboard model and hardware revision
• BIOS and Intel ME/CSME firmware versions
• Exported EkCert.cer
• Issuer, subject, validity dates, and certificate thumbprint
• Complete Event ID 87 details
• HTTP status, 0x80190190, timestamp, and Microsoft request ID
• Confirmation that Intel’s EK provisioning endpoint is reachable
• Whether the machine underwent a motherboard replacement or retained an older Windows installation

Ask ASUS/Intel to confirm that this board’s PTT EK certificate and any required intermediate/platform certificates are correctly provisioned by that firmware. The exact Intel PTT failure has also been reported through Intel’s support community.[^7^](https://community.intel.com/t/intel-ptt-adl-aik-enrollment-fails-http-400-no-valid-tpm-ek-platform-certificate-call-of-duty-attestation/144156 "Intel PTT (ADL) AIK enrollment fails HTTP 400 "No ... - Intel Communities")

If ASUS/Intel confirms that the emitted chain is valid, open a Microsoft support case for the AIK enrollment service and include the same package. End users cannot override server-side EK trust validation.

Avoid clearing the TPM initially

A TPM clear removes TPM-backed keys and can affect Windows Hello, BitLocker-protected data, virtual smart cards, and other protected credentials. Microsoft recommends backing up recovery material and using Windows—not UEFI—to clear it.^8^

Because the TPM is already reported as ready and the service is returning a specific certificate rejection, clearing it is only a later fallback if ASUS or Microsoft explicitly identifies stale TPM ownership/provisioning as the condition.

References

1. Intel Alder Lake PTT AIK Enrollment Failure – HTTP 400 (0x80190190 ...
2. Azure AIK enrollment fails with 0x80190190: “No valid TPM EK/Platform ...
3. Control the health of Windows devices
4. Update Your Security Processor (TPM) Firmware
5. Certificate Chain
6. TPM Key Attestation
7. Intel PTT (ADL) AIK enrollment fails HTTP 400 "No ... - Intel Communities
8. Troubleshoot the TPM