how to generate attestation for TPM SRK?

after reading a lot, i still have a question. How to provide reasonable proof of SRK_pub being bound to given TPM? Working in windows 10 tpm context. Creating attestation for normal platform keys using AIK is straightforward. However for hostage keys (wrapped key import), you need to use storage root key and you need to send this key to server. It is not clear how to generate ai attestation for this key. Normal certify command with this key (0x40000000) fails with error 0x84. thanks