Download intermediate CA cert for Azure Cloud Virtual TPM CA - 11

Question

Download intermediate CA cert for Azure Cloud Virtual TPM CA - 11

proxiML 0

My TPM AIK is issued by "Azure Cloud Virtual TPM CA - 11" but I am unable to download it's certificate here: https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-faq?tabs=adhoccli%2Ctemplate%2Cdebianbased#download-instructions. One of the CAs listed on that page expired 6 months ago and no new ones have been added.

Himanshu Shekhar 6,145 Reputation points Microsoft External Staff Moderator

2026-05-21T01:14:38.38+00:00
The behavior you are observing is expected due to how Azure Trusted Launch manages vTPM certificate authorities (CAs). In your case, the AIK certificate issued by “Azure Cloud Virtual TPM CA - 11” indicates that a newer CA is being used by the platform. However, the public documentation currently provides only a subset of CA certificates for download (root and selected intermediate CAs).

As per Microsoft documentation, Trusted Launch uses a certificate chain (Root CA + Intermediate CA) to establish trust, and these certificates are platform-managed and periodically updated:

https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-faq?tabs=adhoccli%2Ctemplate%2Cdebianbased#download-instructions

This means:

The CA used in your environment may not yet be listed or downloadable from the public page

The certificate is still valid and trusted within Azure

The gap is due to CA rotation / documentation lag, not an issue with your VM or vTPM

At this stage, you can use the available Azure Virtual TPM Root Certificate Authority 2023 and documented intermediate chain to validate trust
proxiML 0 Reputation points

2026-05-21T01:18:50.08+00:00

No you cannot use the documented intermediate chain to validate trust because the documented chain is missing the certificate that is showing up in my VM. I need you to publish the certificate that actually signs the TPM certificate so I can perform validation. You can just send it to me if updating the public documentation is too difficult. I basically cannot start my VMs because the chain is missing a link.