gravitational/teleport · error

signChallenge not implemented for TPM devices

Error message

signChallenge not implemented for TPM devices

What it means

Sentinel-style unimplemented error returned unconditionally by signChallenge on Windows. Device Trust signing for TPM-backed devices was never implemented: enrollment and activation work via windowsDevice/activateCredentialInElevatedChild, but any attempt to sign a challenge fails here, so TPM-enrolled Windows devices cannot complete device authentication challenges.

Source

Thrown at lib/devicetrust/native/device_windows.go:60

)

// deviceStateFolderName starts with a "." on Windows for backwards
// compatibility, but in practice it does not need to.
const deviceStateFolderName = ".teleport-device"

var windowsDevice = &tpmDevice{
	isElevatedProcess: func() (bool, error) {
		return windows.GetCurrentProcessToken().IsElevated(), nil
	},
	activateCredentialInElevatedChild: activateCredentialInElevatedChild,
}

func enrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
	return windowsDevice.enrollDeviceInit()
}

func signChallenge(chal []byte) (sig []byte, err error) {
	return nil, errors.New("signChallenge not implemented for TPM devices")
}

func getDeviceCredential() (*devicepb.DeviceCredential, error) {
	return windowsDevice.getDeviceCredential()
}

func solveTPMEnrollChallenge(
	chal *devicepb.TPMEnrollChallenge,
	debug bool,
) (*devicepb.TPMEnrollChallengeResponse, error) {
	return windowsDevice.solveTPMEnrollChallenge(chal, debug)
}

func solveTPMAuthnDeviceChallenge(
	chal *devicepb.TPMAuthenticateDeviceChallenge,
) (*devicepb.TPMAuthenticateDeviceChallengeResponse, error) {
	return windowsDevice.solveTPMAuthnDeviceChallenge(chal)
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Enroll the device on a supported platform (e.g. macOS)
2. File an issue with Teleport to request Windows TPM signChallenge support

When it happens

Trigger: Thrown at lib/devicetrust/native/device_windows.go:60 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/4c1bce86f29c2013. Report an issue: GitHub.