I know this error is infuriating. You're trying to set up Windows Hello, or BitLocker is nagging you to back up your recovery key, and Windows throws TPM_E_INAPPROPRIATE_SIG (0x80280027) at you like that explains anything. It doesn't. "Signed data cannot include additional DER information" is TPM-speak for: the signature blob Windows handed the chip had extra bytes it didn't expect, so the chip refused to verify it.
What you actually see is a failed attestation. Windows Hello face or PIN setup silently fails, BitLocker won't seal, or Device Manager shows a yellow bang on the TPM with this code. Common triggers: a firmware update that changed the endorsement key certificate format, a Windows cumulative update that bumped the attestation stack, or moving a drive between machines with BitLocker still armed. The DER problem is almost always on the software side, not the chip.
Work through these in order. Stop when it's fixed — you don't need to do the advanced stuff if step one works.
Step 1 — The 30-second fix: clear the stale attestation cache
Before you touch the TPM, kill the cached attestation data. Windows keeps a signed blob under %ProgramData%\Microsoft\Crypto\RSA\ and inside the Microsoft\Crypto\Keys store, and if that blob was signed before a firmware or OS change, every verification after that returns 0x80280027. Deleting it forces Windows to re-request a fresh signature from the TPM.
- Open an elevated Command Prompt (right-click Start → Terminal (Admin)).
- Run this to stop the TPM-related services cleanly:
net stop TBS
net stop "Windows Defender Advanced Threat Protection"
net stop NgcSvc
- Delete the stale signing cache:
del /f /q "%ProgramData%\Microsoft\Crypto\RSA\MachineKeys\*"
del /f /q "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\*"- Reboot. Try Windows Hello or BitLocker again.
If the error's gone, you're done. If it comes back within a day, the underlying cert format is genuinely mismatched — jump to step 3.
Step 2 — The 5-minute fix: reset the TPM's owned state
If the cache clear didn't hold, the TPM's ownership blob is out of sync with the OS's attestation stack. This happens a lot after a firmware flash where the vendor swapped the EK certificate's DER encoding from an older ASN.1 layout to the newer one. Clearing the TPM re-initializes ownership against the current OS.
Warning: If BitLocker is active, suspend it first or you'll lock yourself out. Run manage-bde -protectors -disable C: -rebootcount 1 before you continue.
- Press Win+R, type
tpm.msc, hit Enter. - In the right pane, click Clear TPM.
- Windows will ask you to restart. Do it immediately — don't defer.
- After reboot, the TPM shows as Ready for use with a fresh ownership state.
- Re-enable BitLocker protectors:
manage-bde -protectors -enable C:
Re-run Windows Hello setup. If it completes, the DER mismatch was on the OS side and you're finished. If tpm.msc won't let you clear because the chip reports Not Ready, jump to step 3.
Step 3 — The 15-minute fix: firmware-level repair
Now we're in the weeds. Two things can force you here: the TPM is stuck in a state where tpm.msc refuses to clear it, or you've cleared it and 0x80280027 still fires immediately on attestation. Both point to the firmware itself or a mismatched attestation service.
3a. Update TPM firmware
Check your OEM's TPM firmware page. Dell, HP, Lenovo, and Microsoft Surface all publish TPM 2.0 firmware updates that specifically fix EK certificate encoding bugs. Known culprits:
- Infineon TPMs on older Lenovo ThinkPads (T480, T490) — firmware 7.2.1.0 and earlier shipped an EK cert with a non-canonical DER length. Update to 7.2.2.0 or later.
- STMicro TPMs on some Dell Latitude 5000-series — the 1.3.0.0 firmware had the same class of bug. Dell fixed it in 1.4.0.1.
- Nationz TPMs on budget laptops — usually no fix; you'll need to disable attestation entirely (see 3c).
Apply the OEM firmware update, reboot, then run tpm.msc → Clear TPM again. Re-attest.
3b. Rebuild the attestation service
If firmware's current, the Windows attestation service itself is corrupted. This is more common than people think after a bad cumulative update. Run:
dism /online /cleanup-image /restorehealth
sfc /scannow
CertUtil -TPMInfo
CertUtil -TPMInfo should print your TPM version, manufacturer, and a valid EK certificate thumbprint. If it errors with 0x80280027 right there, the OS can't parse the chip's cert at all and 3c is your path.
3c. Disable attestation-only features (the pragmatic escape hatch)
Some TPMs are simply broken at the firmware level and the OEM has abandoned them. In that case, stop fighting the chip and turn off what needs attestation:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\IntegrityServices" /v DisableAttestation /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
This doesn't fix the chip — it tells Windows to stop asking it for signed attestation. Windows Hello PIN and password still work. Face unlock and fingerprint may stop; PIN is your fallback. BitLocker still functions with a TPM-only protector, though you lose the pre-boot attestation guarantee.
Quick diagnosis table
| Symptom | Most likely cause | Go to |
|---|---|---|
| Error appears once, then setup works | Stale cache after update | Step 1 |
| Error returns after reboot | Ownership desync | Step 2 |
tpm.msc shows chip but Clear fails | Firmware bug | 3a |
CertUtil -TPMInfo errors immediately | Bad EK cert encoding | 3b then 3c |
| OEM has no firmware update available | Abandoned TPM | 3c |
What won't help
- Reinstalling Windows. The cert format lives on the chip, not the OS image. Fresh install, same error.
- Running the TPM troubleshooting tool from Microsoft. It just runs the same Clear TPM you already tried.
- Disabling and re-enabling the TPM in BIOS. This sometimes helps as a hard reset (it forces a firmware self-test), but if Clear TPM in Windows already failed, BIOS toggling usually won't move the needle.
- Registry hacks beyond 3c. I've seen forum posts suggesting editing
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPMvalues — don't. That service doesn't parse the signature; the attestation stack does.
One last thing: if you're on Windows 10 21H2 or earlier with a TPM that predates 2018, upgrade to Windows 11 23H2 or later if the hardware allows. Microsoft quietly tightened the attestation stack's DER parsing in 22H2, and a lot of these 0x80280027 reports dried up on that build. If the hardware doesn't support Windows 11, step 3c is your permanent answer — and it's a fine answer. A working PIN beats a broken face unlock every day.