Enterprise PKI: Key Attestation fails with "Error Cannot Process TPM Attestation"

hello folks,

i'm trying set tpm protected computer-certificates key attestation.

i've set according wesh's guides ("setting tpm protected certificates using microsoft certificate authority"), however, "key attestation" enabled (be "forced" or "force if supported client"), issuing certificate fails following error:

log name:      application  source:        microsoft-windows-certificationauthority  date:          01.02.2017 11:00:41  event id:      22  task category: none  level:         error  keywords:        user:          system  computer:      issca.xxx  description:  active directory certificate services not process request 25 due error:
the parameter incorrect. 0x80070057 (win32: 87 error_invalid_parameter).
the request xxx\client1$.  additional information: error cannot process tpm attestation  

"client1" in example above win10 v1607 vm virtual tpm (hyperv host win10 v1607), same error using physical machine (tested surface 3 pro).

i've tested key attestation types "user credentials" "endorsement key", both result in same error.

when using "endorsement key", can verify pkpubkey hash correctly available on issuing ca:

ps c:\> confirm-caendorsementkeyinfo -publickeyhash d574ec599d6945c7bf7213f6820f9be4f42d0b8979dea8fa5e6005ac90666666  true  

disabling key attestation in cert template results in successful requests same clients. issuing ca patch (and freshly installed) server 2012r2, whole environment (domain,pki) freshly installed (using 2012r2 servers).

during investigations on fault i've found suitable msft kb article, it's available in google cache longer (no links allowed, kb3154769), assume not relevant (also because machines patched).

i'd thankful on hints on issue.

thanks in advance,

yours,

juergen

hello,

problem solved: stated before root cause was, issuing ca certificate did not have "issuancepolicies" added.

note root ca certificate automatically gets "all issuance policies" oid added (this seems happen automagically self-signed certificates). however, since last few server versions, "all issuance policies" oid not being "inherited" ca certificates issued our root ca, issuing ca certificates have "all application policies" purpose, no issuance policies.

as issuance policies need valid across whole certification tree, our ca not able issue certificate templates requesting - in example - "endorsement key verified" issuance policy.

to things working, create %systemroot%\capolicy.inf file on issuing ca following content:

[version]  signature="$windows nt$"  [policystatementextension] policies = allissuancepolicy critical = false  [allissuancepolicy] oid = 2.5.29.32.0

now request new ca certificate , see "all issuance policies" purpose being added new ca cert.

note: documentation on usage of "issuance policies" sparse. *assume* clean setup require add required oids capolicy.inf file (instead of "all issuance policies" oid), however, issuance policies enforced certificate templates, not see security issue when using "all issuance policies" setting ca cert. (--> please correct me if i'm wrong)

after that, "endoresement key verified" certificate template can rolled out correctly!

important update: i've realised, described resolution only works server 2016 issuing ca! error on primary server 2012 r2 based ca remains same, although using identical settings!

case closed :)

yours,

juergen

Windows Server  >  Security