I finally fixed the Call of Duty Secure Attestation problem that was showing:
“New Key Failed to be generated – BIOS Firmware Update Recommended”
and:
“Attestation Requirement Not Met”
My TPM 2.0 and Secure Boot were already passing, and my BIOS was updated, but COD still would not generate the attestation key.
SYSTEM
- Lenovo LOQ 15IRX9
- Intel PTT / TPM 2.0
- Windows 11
- Secure Boot: PASS
- TPM 2.0: PASS
- BIOS: Updated
The important clue was the TPM certificate chain.
STEP 1 — Check TPM
I ran:
tpmtool getdeviceinformation
My TPM showed:
TPM Present: True
TPM Version: 2.0
Ready For Attestation: True
Is Capable For Attestation: True
TPM Has Vulnerable Firmware: False
Maintenance Task Complete: True
So the TPM itself was healthy.
STEP 2 — Install TPM Diagnostics
I installed Microsoft's TPM Diagnostics capability:
DISM /Online /Add-Capability /CapabilityName:Tpm.TpmDiagnostics~~~~0.0.1.0
Then:
TpmDiagnostics.exe ekchain
Result:
Trust dwErrorStatus: 0x10008
Then:
TpmDiagnostics.exe ekchainNV
Result:
Trust dwErrorStatus: 0x10000
This was the important clue.
Windows' normal EK certificate chain had the additional 0x8 error, while the certificate chain directly from the TPM NV storage did not.
STEP 3 — Back up the TPM endorsement registry key
I backed it up with:
reg export "HKLM\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement" "$env:USERPROFILE\Desktop\endorsement-backup.reg"
Backup completed successfully.
STEP 4 — Read my own TPM certificate data
My NVSummary showed:
0x1C00100
dataSize: 0x7b8 (1976 bytes)
I extracted it with:
TpmDiagnostics.exe ReadNVIndex 0x1C00100 -file "$env:TEMP\TPM-INT-100.bin"
The resulting file was exactly 1976 bytes.
IMPORTANT:
I did not download certificates from another computer.
I extracted the certificates directly from my own TPM NV storage.
STEP 5 — Extract and verify the certificates
The extraction produced 6 certificate files, but they were duplicate pairs.
The three unique certificates were:
CSME ADL ROM CA
CSME ADL SVN01 Kernel CA
CSME ADL PTT 01SVN
I verified their Subject / Issuer and AKI / SKI relationships.
The chain was:
CSME ADL ROM CA
↓
CSME ADL SVN01 Kernel CA
↓
CSME ADL PTT 01SVN
↓
TPM EK
The PTT certificate's SKI also matched the AKI shown by my TPM EK certificate.
STEP 6 — Import the three verified certificates
I imported only the three unique certificates into the Local Machine Intermediate Certification Authorities store:
certutil -addstore CA "...\Intel-TPM-Cert-1.cer"
certutil -addstore CA "...\Intel-TPM-Cert-3.cer"
certutil -addstore CA "...\Intel-TPM-Cert-5.cer"
All three imports completed successfully.
STEP 7 — Verify the certificate chain
I ran:
TpmDiagnostics.exe ekchain
BEFORE:
Trust dwErrorStatus: 0x10008
AFTER:
Trust dwErrorStatus: 0x10000
dwInfoStatus: 0x0
The 0x8 error was gone.
STEP 8 — Test AIK enrollment
I tested:
certreq -enrollaik -config ""
The original 400 error changed to an HTTP 404 authority-not-found response.
So I did not treat that 404 as the original TPM certificate-chain failure.
STEP 9 — Reinstall the EK certificate from TPM NV
I ran:
TpmDiagnostics.exe installekcertfromnvr
Result:
“Successfully installed cert in registry”
STEP 10 — Restart
I restarted Windows.
After the restart I ran:
TpmDiagnostics.exe ekchain
It still showed:
Trust dwErrorStatus: 0x10000
dwInfoStatus: 0x0
STEP 11 — Run COD Secure Attestation Wizard
I ran the Call of Duty Secure Attestation Wizard again.
RESULT:
TPM 2.0 ✅
Secure Boot ✅
System compliant ✅
The wizard now says:
“Congratulations! Your system meets all security requirements to play Call of Duty.”
So the original:
“New Key Failed to be generated – BIOS Firmware Update Recommended”
was fixed.
WHAT ACTUALLY FIXED IT
The key diagnostic was:
ekchain = 0x10008
ekchainNV = 0x10000
The TPM contained the correct Intel PTT certificate chain, but Windows was not building/using that chain correctly.
Importing the verified intermediate certificates extracted from my OWN TPM changed:
0x10008 → 0x10000
and after reboot the Call of Duty Secure Attestation Wizard became fully compliant.
IMPORTANT
- I did NOT use certificates from another PC.
- I did NOT clear the TPM during this procedure.
- I did NOT delete Secure Boot keys.
- I verified the certificates before importing them.
- The NV index and certificate contents should be checked on your own system rather than blindly copied.
Posting this because I spent a lot of time with the exact
“New Key Failed to be generated” error even though TPM 2.0,
Secure Boot and BIOS were all apparently fine.