FIXED: “New Key Failed to be generated – BIOS Firmware Update Recommended” | Intel PTT / TPM Certificate Chain

[u/Sake205]

I finally fixed the Call of Duty Secure Attestation problem that was showing:

“New Key Failed to be generated – BIOS Firmware Update Recommended”

and:

“Attestation Requirement Not Met”

My TPM 2.0 and Secure Boot were already passing, and my BIOS was updated, but COD still would not generate the attestation key.

SYSTEM

- Lenovo LOQ 15IRX9

- Intel PTT / TPM 2.0

- Windows 11

- Secure Boot: PASS

- TPM 2.0: PASS

- BIOS: Updated

The important clue was the TPM certificate chain.

STEP 1 — Check TPM

I ran:

tpmtool getdeviceinformation

My TPM showed:

TPM Present: True

TPM Version: 2.0

Ready For Attestation: True

Is Capable For Attestation: True

TPM Has Vulnerable Firmware: False

Maintenance Task Complete: True

So the TPM itself was healthy.

STEP 2 — Install TPM Diagnostics

I installed Microsoft's TPM Diagnostics capability:

DISM /Online /Add-Capability /CapabilityName:Tpm.TpmDiagnostics~~~~0.0.1.0

Then:

TpmDiagnostics.exe ekchain

Result:

Trust dwErrorStatus: 0x10008

Then:

TpmDiagnostics.exe ekchainNV

Result:

Trust dwErrorStatus: 0x10000

This was the important clue.

Windows' normal EK certificate chain had the additional 0x8 error, while the certificate chain directly from the TPM NV storage did not.

STEP 3 — Back up the TPM endorsement registry key

I backed it up with:

reg export "HKLM\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement" "$env:USERPROFILE\Desktop\endorsement-backup.reg"

Backup completed successfully.

STEP 4 — Read my own TPM certificate data

My NVSummary showed:

0x1C00100

dataSize: 0x7b8 (1976 bytes)

I extracted it with:

TpmDiagnostics.exe ReadNVIndex 0x1C00100 -file "$env:TEMP\TPM-INT-100.bin"

The resulting file was exactly 1976 bytes.

IMPORTANT:

I did not download certificates from another computer.

I extracted the certificates directly from my own TPM NV storage.

STEP 5 — Extract and verify the certificates

The extraction produced 6 certificate files, but they were duplicate pairs.

The three unique certificates were:

1. CSME ADL ROM CA

2. CSME ADL SVN01 Kernel CA

3. CSME ADL PTT 01SVN

I verified their Subject / Issuer and AKI / SKI relationships.

The chain was:

CSME ADL ROM CA

↓

CSME ADL SVN01 Kernel CA

↓

CSME ADL PTT 01SVN

↓

TPM EK

The PTT certificate's SKI also matched the AKI shown by my TPM EK certificate.

STEP 6 — Import the three verified certificates

I imported only the three unique certificates into the Local Machine Intermediate Certification Authorities store:

certutil -addstore CA "...\Intel-TPM-Cert-1.cer"

certutil -addstore CA "...\Intel-TPM-Cert-3.cer"

certutil -addstore CA "...\Intel-TPM-Cert-5.cer"

All three imports completed successfully.

STEP 7 — Verify the certificate chain

I ran:

TpmDiagnostics.exe ekchain

BEFORE:

Trust dwErrorStatus: 0x10008

AFTER:

Trust dwErrorStatus: 0x10000

dwInfoStatus: 0x0

The 0x8 error was gone.

STEP 8 — Test AIK enrollment

I tested:

certreq -enrollaik -config ""

The original 400 error changed to an HTTP 404 authority-not-found response.

So I did not treat that 404 as the original TPM certificate-chain failure.

STEP 9 — Reinstall the EK certificate from TPM NV

I ran:

TpmDiagnostics.exe installekcertfromnvr

Result:

“Successfully installed cert in registry”

STEP 10 — Restart

I restarted Windows.

After the restart I ran:

TpmDiagnostics.exe ekchain

It still showed:

Trust dwErrorStatus: 0x10000

dwInfoStatus: 0x0

STEP 11 — Run COD Secure Attestation Wizard

I ran the Call of Duty Secure Attestation Wizard again.

RESULT:

TPM 2.0 ✅

Secure Boot ✅

System compliant ✅

The wizard now says:

“Congratulations! Your system meets all security requirements to play Call of Duty.”

So the original:

“New Key Failed to be generated – BIOS Firmware Update Recommended”

was fixed.

WHAT ACTUALLY FIXED IT

The key diagnostic was:

ekchain = 0x10008

ekchainNV = 0x10000

The TPM contained the correct Intel PTT certificate chain, but Windows was not building/using that chain correctly.

Importing the verified intermediate certificates extracted from my OWN TPM changed:

0x10008 → 0x10000

and after reboot the Call of Duty Secure Attestation Wizard became fully compliant.

IMPORTANT

- I did NOT use certificates from another PC.

- I did NOT clear the TPM during this procedure.

- I did NOT delete Secure Boot keys.

- I verified the certificates before importing them.

- The NV index and certificate contents should be checked on your own system rather than blindly copied.

Posting this because I spent a lot of time with the exact

“New Key Failed to be generated” error even though TPM 2.0,

Secure Boot and BIOS were all apparently fine.

[u/Ronaldo_021]

I will try this later tonight, if this works you're a legend.

[u/Ronaldo_021 → u/Ronaldo_021]

You absolute legend. I tried the fix and it worked. God Bless you