Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

verification failed because collateral is out of date #20

Closed
sho4510 opened this issue Jan 9, 2024 · 1 comment
Closed

verification failed because collateral is out of date #20

sho4510 opened this issue Jan 9, 2024 · 1 comment

Comments

@sho4510
Copy link

sho4510 commented Jan 9, 2024

I ran Attest enclave but it failed

[ using our own SGX-measurement verification callback (via command line options) ]
  - ignoring ISV_PROD_ID
  - ignoring ISV_SVN

  . Seeding the random number generator... ok
  . Connecting to tcp/localhost/8552... ok
  . Setting up the SSL/TLS structure... ok
 ok
  . Installing RA-TLS callback ... ok
  . Performing the SSL/TLS handshake...WARNING: The ra_tls_verify_callback_der() API is deprecated in favor of the ra_tls_verify_callback_extended_der() version of API.
Azure Quote Provider: libdcap_quoteprov.so [ERROR]: Could not retrieve environment variable for 'AZDCAP_DEBUG_LOG_LEVEL'
WARNING: The collateral is out of date.
ra_tls_verify_callback: Quote: verification failed because collateral is out of date
 failed
  ! mbedtls_ssl_handshake returned -0x3000

Is it the same as the problem below?
"DCAP returns outdated collateral for Azure DCsv2/v3 machines"
microsoft/Azure-DCAP-Client#154

@fnerdman
Copy link
Collaborator

Looks like that issue. Never had an issue with out of date collateral, as it was just a warning. It should be an error though. If none of the fixes in that issue work, you should verify against Intel directly instead of going through MS. Basically remove az-dcap-client from the attestation verification instance and install all packets required to verify attestation with intel. Sadly, If I recount correctly, you need a full PCCS setup for that as well. There's also onchain DCAP attestation: https://github.com/automata-network/automata-dcap-v3-attestation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants