All: I finally resolved my Call of Duty / RICOCHET attestation problem after nearly three months of troubleshooting, and I wanted to document it here because in my case the MSI BIOS and AMD fTPM were not actually the remaining problem.
My system is an MSI X570-A PRO with AMD fTPM. TPM 2.0, Secure Boot, UEFI, measured boot, and the current BIOS/fTPM configuration were all healthy. Windows itself reported the machine as capable of attestation, yet Call of Duty continued to fail secure attestation.
The eventual problem appeared to be an existing application-specific TPM key container named ActivisionAIK that had become stale or otherwise invalid.
I did NOT clear the TPM, reset Secure Boot keys, reinstall Windows, or change hardware.
Open PowerShell as Administrator.
Step 1 — Confirm that the Activision-specific AIK already exists:
certutil.exe -csp "Microsoft Platform Crypto Provider" -key ActivisionAIK
IMPORTANT: If ActivisionAIK does NOT exist at this point, STOP. This probably is not the same failure mode. I would not recommend deleting or resetting unrelated TPM material trying to force this fix.
In my case, ActivisionAIK already existed even though Activision's own broker logs showed failed AIK enrollment attempts earlier in the history of the problem.
Step 2 — Delete ONLY the application-specific ActivisionAIK container:
certutil.exe -csp "Microsoft Platform Crypto Provider" -delkey ActivisionAIK
This does not clear the TPM. It removes only the named ActivisionAIK container.
Step 3 — Verify that the old container is actually gone:
certutil.exe -csp "Microsoft Platform Crypto Provider" -key ActivisionAIK
In my case, the expected result was:
0x80090016 NTE_BAD_KEYSET
Keyset does not exist.
That was intentional. At this point I knew the old application-specific key had actually been removed.
Step 4 — Re-enroll a fresh ActivisionAIK:
cmd.exe /c 'certreq.exe -enrollaik -f -q -machine -config "" ActivisionAIK'
Successful enrollment on my machine returned:
PkiStatus(0): SCEPDispositionSuccess
EnrollStatus(1): Enrolled
HTTP/1.1 200 OK
Key = ActivisionAIK
The operation completed successfully. 0x0
Immediately afterward I reran the Call of Duty Secure Attestation Wizard.
The same machine that had been failing attestation immediately changed to:
SYSTEM COMPLIANT
I then verified the result in both my Battle.net Call of Duty installation and the Xbox/Microsoft Store MW4 beta, including before and after a Windows restart. The attestation failure did not return.
The important distinction here is that this was not a general TPM repair.
My TPM was already ready, TPM 2.0 was active, Secure Boot was enabled, UEFI was correct, and the MSI/AMD firmware side had already been updated. The remaining failure appeared to be the persisted Activision-specific AIK identity back from the June digital handshake despite multiple handshakes since then being fine between my PC, Activision, and Azure.
If your TPM/Secure Boot configuration is actually unhealthy, or ActivisionAIK does not already exist in Step 1, you likely have a different problem. For anyone who has already updated the appropriate MSI BIOS/AMD fTPM firmware and Call of Duty still reports an attestation failure, particularly when the normal TPM and Secure Boot checks are passing, this may be worth checking before clearing the entire TPM or reinstalling Windows.
Attached are two screenshots of the Attestation Wizard (August version) before and after running the above 4 steps in PowerShell.
