Windows AIK enrollment fails with HTTP 404 for Microsoft Pluton MSFT-KeyId

Framework Desktop
1

I have a Framework Desktop with Microsoft Pluton TPM 2.0. I’m trying to run the new beta of Modern Warfare 4 which requires Secure Boot and TPM attestation.

My configuration:

  • BIOS: 3.06
  • TPM firmware: 10.7.0.2
  • TPM revision: 1.59
  • Secure Boot: enabled
  • Windows is installed on a SATA SSD connected through a USB adapter

I also ran Activision’s Secure Attestation Wizard:

It reports:

  • Secure Boot: OK
  • TPM 2.0: OK
  • TPM attestation: Failed
  • Firmware upgrade: Required

The problem is that I’m already running the latest Framework BIOS (3.06) so there doesn’t appear to be a newer BIOS/firmware update available.

While debugging this I found that Windows cannot successfully enroll the TPM Attestation Identity Key (AIK):

certreq.exe -enrollaik -f -machine -config ""
MSFT-KeyId-<REDACTED>
https://MSFT-KeyId-<REDACTED>.microsoftaik.azure.net/templates/Aik/scep
GetCACaps
GetCACaps: Not Found
HTTP/1.1 404 Not Found

"The authority msft-keyid-<REDACTED>.microsoftaik.azure.net does not exist."

EnrollStage = 140
Error: 0x80190194 (HTTP_E_STATUS_NOT_FOUND)

The failure happens before CreateRequest / SubmitRequest. As a result, Windows TPM attestation never reaches Ready For Attestation.

I’d particularly like to know whether:

  1. this is a known issue with the current Pluton firmware (10.7.0.2),
  2. a newer Pluton firmware is available independently of the Framework BIOS,
  3. the Framework Desktop’s Pluton/TPM configuration requires some additional provisioning, or
  4. the Microsoft AIK enrollment service needs to recognize/register these TPMs.

I’ve already sent the diagnostic information to Framework Support including the relevant key information, but I’m posting here in case anyone else has encountered this.