Hardware & Attestation
What Is TPM Attestation?
TPM attestation is the mechanism by which a Trusted Platform Module — the security chip in effectively every business PC — proves cryptographically that a key was generated inside genuine hardware and is non-exportable. The proof is a certificate chain from the key up to the TPM manufacturer, verifiable by anyone, and it underpins device trust in zero-trust and certificate enrollment scenarios.
How the proof is built
Each TPM ships with an Endorsement Key (EK) whose certificate is signed by the manufacturer (Infineon, STMicro, Nuvoton…). When a new key is created, the TPM can produce an attestation statement tying that key to the EK — asserting properties like "generated in-TPM" and "non-exportable". Verifying the chain — key statement → EK certificate → manufacturer root — proves the key never existed in software.
Where TPM attestation is used
Windows uses it for Device Health and Windows Hello for Business; ADCS can require TPM key attestation before issuing certificates, so only hardware-bound keys receive credentials; MDM platforms use it to gate enrollment to genuine corporate devices; and cloud confidential-computing attestation applies the same pattern at datacenter scale. The common thread: policy decisions anchored in hardware facts rather than software claims.
Verifying an attestation
Verification means walking the chain against the manufacturer’s published roots and checking the attested properties. The manufacturer root lists are public but scattered — which is why a dedicated verification tool saves an afternoon of certificate archaeology per vendor.
Try it yourself — free tools
- HSM Attestation Checker — verify TPM and security-key attestations against manufacturer roots
- Certificate Checker — inspect EK certificates and attestation chains manually
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- Hardware Security Module (HSM)Tamper-resistant hardware that generates and guards cryptographic keys so they can be used but never extracted.
- Certificate Template (ADCS)The ADCS blueprint that defines what a certificate contains, who may enroll, and how the key is protected.
- Key Ceremony & CPSThe witnessed procedure that creates CA keys — and the CP/CPS documents that make the trust auditable.
- Browse all terms →