CoD's Secure Attestation check kept failing on my Raider 16 Max, even with TPM 2.0 and Secure Boot both on. The cause turned out to be Windows not seeing Intel PTT's EK certificate chain, so it couldn't create an attestation key. Here's the full process that fixed it. It should help on other MSI laptops with Intel PTT too.
**System:** MSI Raider 16 Max, Intel PTT (firmware TPM 2.0), Windows 11
**Symptom:** Secure Attestation Wizard failed with "Attestation Requisite not met" / "New Key Generation Required", and the game wouldn't launch.
**Cause:** `certreq -enrollaik` returned HTTP 400 "No valid TPM EK/Platform certificate provided" (0x80190190). The Intel certs are stored in the TPM itself, so I read them out and imported them into Windows.
> ⚠️ Uses admin commands and imports Intel's own EK chain certs (read from your own TPM) into the Local Machine Intermediate CA store. Worked for me, no guarantees on other machines.
**1. Check the basics**
- PowerShell: `Get-Tpm` should show TPM ready, AutoProvisioning Enabled
- BIOS in UEFI mode, Secure Boot ON
**2. Confirm the error (optional), Admin Command Prompt:**
certreq -enrollaik -config ""
If you get 0x80190190, this fix is probably for you.
**3. Install TPM Diagnostics, Admin PowerShell:**
DISM /Online /Add-Capability /CapabilityName:Tpm.TpmDiagnostics~~~~0.0.1.0
**4. Compare EK chains (optional):**
TpmDiagnostics.exe ekchain
TpmDiagnostics.exe ekchainNV
Mine: ekchain = 0x10008, ekchainNV = 0x10000 (chain is in TPM NV memory but Windows wasn't using it).
**5. Read the certs out of the TPM:**
TpmDiagnostics.exe ReadNVIndex 0x1C00100 -file "$env:TEMP\NV-1C00100.bin"
TpmDiagnostics.exe ReadNVIndex 0x1C00101 -file "$env:TEMP\NV-1C00101.bin"
**6. Convert to .cer files (same PowerShell window):**
$nv = [IO.File]::ReadAllBytes("$env:TEMP\NV-1C00100.bin") + [IO.File]::ReadAllBytes("$env:TEMP\NV-1C00101.bin")
$out = New-Item -ItemType Directory -Force "$env:TEMP\TPM-Intel-Certs"
$n = 0
for ($i = 0; $i -lt $nv.Count - 4; $i++) {
if ($nv[$i] -eq 0x30 -and $nv[$i+1] -eq 0x82) {
$len = $nv[$i+2] * 256 + $nv[$i+3] + 4
if ($i + $len -le $nv.Count) {
try {
$cert = New-Object Security.Cryptography.X509Certificates.X509Certificate2 (,[byte[]]$nv[$i..($i+$len-1)])
$n++
[IO.File]::WriteAllBytes("$($out.FullName)\intel-cert-$n.cer", $cert.RawData)
"$n. $($cert.Subject)"
$i += $len - 1
} catch { }
}
}
}
It should print the Intel cert subjects.
**7. Import them, Admin PowerShell:**
Get-ChildItem "$env:TEMP\TPM-Intel-Certs\*.cer" | ForEach-Object { Import-Certificate -FilePath $_.FullName -CertStoreLocation Cert:\LocalMachine\CA }
**8. Re-run the Secure Attestation Wizard.** Mine passed ("Congratulations, your system meets all security requirements to play Call of Duty") and the game launched.
**To undo:** run `certlm.msc`, go to Intermediate Certification Authorities, then Certificates, and delete the Intel certs you imported.
Anyone else on a Raider/Titan/Vector hit this? Let me know if it works on yours.
