TPM EK enrollment issue.

Hello Pratik Dongale,

It seem you have connected TPM chip (SLB9673) to an ESP32 microcontroller via I2C, and using the WolfTPM library to generate and read the TPM EK. The generated EK is then submitted to Azure DPS for enrollment, but Azure rejects it with the error above.

Endorsement key is invalid, or does not match the Enrollment. Error code: 400004

Likely Cause of the Error

This error typically indicates that the EK submitted to Azure DPS is either:

• Not in the correct format (e.g., not properly base64-encoded),
• Not the actual public EK from the TPM,
• Or does not match the EK expected by the enrollment entry in DPS.

What we can do

1. EK Certificate Verification: Make sure that the EKPub of your device (linked to the TPM EK) is on the PKI administrator-managed list. If it's not, Azure will reject the key. You can check if the EK is properly set up with the following steps:
   • Extract your EK certificate using the PowerShell cmdlet:

     
          $a=Get-TpmEndorsementKeyInfo
     
          $a.manufacturerCertificates|Export-Certificate -filepath c:\myEkcert.cer
     
     

   • Verify that this EKCert is trusted by your Certificate Authority (CA) using:

     
          Confirm-CAEndorsementKeyInfo -PublicKeyHash <your-EK-Pub-hash>
     
     

   Make sure the EKPub is included in the EK list on the CA.
2. Template and Cryptography Settings: Ensure the certificate template used for the EK is correctly configured. Specifically, it should be compatible with your operating environment (Windows Server 2012 R2) and the cryptography settings should utilize the Microsoft Platform Crypto Provider.
3. TPM Ownership: If the TPM does not have an Endorsement Key pair (which can occur if it wasn't provisioned correctly), consider taking ownership of the TPM and generating a new EK pair.
4. Validate EK Format: Ensure the EK is base64-encoded correctly and matches the expected RSA or ECC format. You can decode and inspect it using OpenSSL or similar tools.
5. Use Supported TPM and OS Versions: Make sure your device meets the minimum requirements:

• TPM 2.0
• Windows 10/11 (if applicable)
• Physical device (not VM or emulator)

Reference - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/tpm-key-attestation

Let me know if this helps or if you need further assistance!
Thank you!

Hello Pratik Dongale,

Following up to check if the responses provided helped you. Please feel free reach us for further help.

Thank you!

Hi VSawhney,

Thanks for the reply.
we have external TPM chip on the board interfaced with esp32 microcontroller on I2C interface. we suppose to generate a Endorsement key by sending configuration command from esp32 microcontroller over I2C interface using WolfTPM API's. we are able to generate key as mentioned below :Extract your EK certificate

*AToAAQALAAMAsgAgg3GXZ0SEs/gakMyNRqXXJP1S124GYg2gr9JWCrFVjcAABgCAAEMAEAgAAAEAAQEAu/rwV3z8+RpICS3AuzaVf06ZUNI/50iLygUGv/SPT++zRRyYCCRNuPtp7m92OMpy/VJfcP4OXc6G+8sc54RieJHKe9uA0pm/UQeKzqwVOrpwajKJ9hf1cQn5Y5nMgJtjn0Mrr7HuPSbwpQvqutjKLJEys2hMQ6mQ2lc7/QZNleuVxEF2YRnfO0FsF0az58WYKqPEdJrDHVUXgpI44IO2ntpn2Ms6Wi1GOR+yr49KBJS2EGH5sMYFh9taJ+kEqXuXU/UmBGV5yHFdhosBk4clRhxOPuGtH5uccudpWP8bExS1ZBLirkToT0opqiIYytQEf2P+4qISSFjdUfiVmvEPKw==*Next step is we have created instance in azure portal as: global.azure-devices-provisioning.net

while register this key in azure DPS portal we are getting an error invalid Endorsement key as mentioned in initial post.
in this case please guide us how to debug EKCert is trusted by your Certificate Authority (CA).

Template and Cryptography Settings:

Here the environment is ESP-IDF since esp32 microcontroller accessing the TPM key. we are facing the issue when we manually generated key and paste in a azure DPS for initial registration.

TPM Ownership:

This we have done with WolfTPM API as "cpIn.primaryHandle = TPM_RH_ENDORSEMENT;" and tried with generating new key multiple times.

Validate EK Format:

The generated EK is base64-encoded correctly and matches the expected RSA (256bytes).

Use Supported TPM and OS Versions:

Here the environment is ESP-IDF.

Looking forward for your kind response.

Regards,

Pratik D.

Hello Pratik Dongale,
can you try

TpmEndorsementKey = "AToAAQALAAMAsgAgg3GXZ0SEs/gakMyNRqXXJP1S124GUgtk8qHaGzMUaaoABgCAAEMAEAgAAAAAAAEAxsj2gUS" + "cTk1UjuioeTlfGYZrrimExB+bScH75adUMRIi2UOMxG1kw4y+9RW/IVoMl4e620VxZad0ARX2gUqVjYO7KPVt3d" + "yKhZS3dkcvfBisBhP1XH9B33VqHG9SHnbnQXdBUaCgKAfxome8UmBKfe+naTsE5fkvjb/do3/dD6l4sGBwFCnKR" + "dln4XpM03zLpoHFao8zOwt8l/uP3qUIxmCYv9A7m69Ms+5/pCkTu/rK4mRDsfhZ0QLfbzVI6zQFOKF/rwsfBtFe" + "WlWtcuJMKlXdD8TXWElTzgh7JS4qhFzreL0c1mI0GCj+Aws0usZh7dLIVPnlgZcBhgy1SSDQMQ==";

from DOC to create a Device Provisioning Service enrollment for TPM attestation

Hi Sampath,
Thanks for the reply.

TPM key provided by you saved successfully in TPM enrollment.
TPM key you provided >> AToAAQALAAMAsgAgg3GXZ0SEs/gakMyNRqXXJP1S124GUgtk8qHaGzMUaaoABgCAAEMAEAgAAAAAAAEAxsj2gUScTk1UjuioeTlfGYZrrimExB+bScH75adUMRIi2UOMxG1kw4y+9RW/IVoMl4e620VxZad0ARX2gUqVjYO7KPVt3dyKhZS3dkcvfBisBhP1XH9B33VqHG9SHnbnQXdBUaCgKAfxome8UmBKfe+naTsE5fkvjb/do3/dD6l4sGBwFCnKRdln4XpM03zLpoHFao8zOwt8l/uP3qUIxmCYv9A7m69Ms+5/pCkTu/rK4mRDsfhZ0QLfbzVI6zQFOKF/rwsfBtFeWlWtcuJMKlXdD8TXWElTzgh7JS4qhFzreL0c1mI0GCj+Aws0usZh7dLIVPnlgZcBhgy1SSDQMQ==

Please help us to construct the structure of TPM key. I had extracted EK from SLB9673 TPM chip with WolfTPM SDK using wolfTPM2_ReadPublicKey() API then converted in Base64.
Extracted EK from my device >>
rFoj9lGUbzeEiLJPumRgzmS+iXNmGbbVSYClH5ZP0hbK1I5w9p9LuN7Znt46MZhyTCGrny1MXK+F42HXfH9n8pzpYWm9jt03T6oOHYTePyvHX2yryZkRuSrKWC1tbWtTinztmThu84ii6ptqjNnP88FhFEChU7T29nszHDXG9yWA6kUZJdPhTIuDny3ova6Lf1DCYkvxfNsnhNotvfWYCQKq3X9mRjZ5ZB2R7b/CridM5uDqMTt13cTFZUOf6n8QJc34IwBJLpACx0h3j/TUyWAdBO3W20k5hyi4ngs6oeo9WaIeFPWHZyLDUvlOBf8/Kk/IZxuOErpxZGYKqgH0MQ==
I tried with manually marshal the key, still azure reject the TPM key.
Manual marshaled KEY>>
AToAAQALAAQAcgAgyj0KmaK5OQb3ozQkFO/Ps6OF1EzR/UWQidGbUHHAt6AAEAAAAAAAFAgAAAAAAAEArFoj9lGUbzeEiLJPumRgzmS+iXNmGbbVSYClH5ZP0hbK1I5w9p9LuN7Znt46MZhyTCGrny1MXK+F42HXfH9n8pzpYWm9jt03T6oOHYTePyvHX2yryZkRuSrKWC1tbWtTinztmThu84ii6ptqjNnP88FhFEChU7T29nszHDXG9yWA6kUZJdPhTIuDny3ova6Lf1DCYkvxfNsnhNotvfWYCQKq3X9mRjZ5ZB2R7b/CridM5uDqMTt13cTFZUOf6n8QJc34IwBJLpACx0h3j/TUyWAdBO3W20k5hyi4ngs6oeo9WaIeFPWHZyLDUvlOBf8/Kk/IZxuOErpxZGYKqgH0MQ==

Please help us to construct azure expected format of TPM EK. Pleases guide us to resolve this issue ASAP. Consider we are working in embedded c environment. (not windows or OS)

Best regards,
Pratik D.