Microsoft Azure AIK CA returns HTTP 400 for EK signed by Intel ODCA 2 CSME P_ADL 00002341 / CSME ADL SVN01 Kernel CA — same pattern as Infineon CA 035 trust-pool gap

Question

Daniil Zhukov 5

I'm hitting a TPM AIK enrollment failure on Windows 11 25H2 (build 26200.8328) that looks identical to the

previously-resolved Infineon CA 035/039/042 trust-pool gap — but for an Intel CSME branch.

My device: Intel Core i7-13650HX (Raptor Lake HX), Intel PTT 2.0, manufacturer version INTC 600.18.32.2473, ME

firmware 16.1.32.2473 H Consumer.

EK certificate chain (from tpmdiagnostics ekchainnv):

EK ← CSME ADL PTT 01SVN

 ← CSME ADL SVN01 Kernel CA

 ← CSME ADL ROM CA

 ← ODCA 2 CSME P_ADL 00002341 Issuing CA (Intel On-Die CA)

Windows POSTs SCEP request to:

The hash 134d03d6... is the SHA-1 SKI of the ODCA 2 CSME P_ADL 00002341 Issuing CA intermediate cert. The endpoint is

reachable (DNS resolves to prdf.aadg.msidentity.com, TLS handshake OK with CN=graph.windows.net), accepts the POST,

parses the EK, and rejects with:

HTTP/1.1 400 Bad Request

Content-Type: application/json; charset=utf-8

x-ms-request-id: cb67f301-da17-42a1-8bd5-e7fc65234c88

{"Message":"No valid TPM EK/Platform certificate provided in the TPM identity request message."}

Captured from Event Viewer Application log, Event ID 87, multiple instances on 2026-05-11/12. Tpm-HASCertRetr task

succeeds (LastResult=0), so HAS endpoint works — only AIK CA rejects.

This is identical to:

Infineon CA 035/039/042 cases (Microsoft fixed by updating trust pool after escalation — see patchmypc.com and

call4cloud.nl writeups)

Lenovo ThinkBook 14/16 G7 IML with Intel Meteor Lake (firmware INTC 45875219.x) — Microsoft Q&A thread 1861578,

acknowledged by ZhoumingDuan-MSFT, still unresolved

Ruled out as client-side:

TPM cleared via tpm.msc — same issuer, same 400
Intel ODCA Root CA installed in LocalMachine\Root — no change
ECC EK doesn't exist on this TPM
Newer Intel ME 16.1.40.2765 (latest public, 2025-07) still ships same SVN01 chain (verified by binary analysis)
BIOS update — OEM (Colorful) has no newer; all Clevo V25xRNx variants ship same SVN01 chain
certutil -urlcache -delete * + CryptSvc restart — no effect

Question: Has the TCIC bundle for ODCA 2 CSME P_ADL 00002341 Issuing CA been received from Intel and added to the

Azure AIK CA trust pool? If not, can this be routed to the Microsoft TPM trust team for the same kind of fix as the

Infineon precedent?

This affects every Raptor Lake HX laptop with Intel PTT (multiple OEMs share the Clevo V25xRNx barebone — Colorful,

Mechrevo, Hasee, Maibenben). End-users have no client-side path to resolve.

Your answer