topic Re: curl to get pck certificates in Intel® Software Guard Extensions (Intel® SGX)

curl to get pck certificates

Kishore_B_Intel — Tue, 26 Mar 2024 00:12:56 GMT

Hi,

I am trying to run the Get PCK Certificates command mentioned in the below link to get the pck certificates on my EMR platform.

https://sbx.api.portal.trustedservices.intel.com/content/documentation.html#pcs-certificates-v4

curl -v -X GET "https://sbx.api.trustedservices.intel.com/sgx/certification/v4/pckcerts?encrypted_ppid={}&pceid={}" -H "Ocp-Apim-Subscription-Key: {subscription key}"

The command has 3 inputs if I understand correctly.

encrypted_ppid={ }

pceid={ }

subscription-key: { }

Can you tell me where to find the encrypted=ppid and pceid values for the above command?

I am seeing this error when ran the above command.

curl: (3) empty string within braces in URL position 89:
https://sbx.api.trustedservices.intel.com/sgx/certification/v4/pckcerts?encrypted_ppid={}&pceid={}

Thanks

Re: curl to get pck certificates

Scott_R_Intel — Tue, 26 Mar 2024 01:29:40 GMT

Hi Kishore_B.

You can use our PCK Cert ID Retrieval Tool to get the EncPPID and PCEID for your platform:

https://github.com/intel/SGXDataCenterAttestationPrimitives/tree/master/tools/PCKRetrievalTool

See the "Output File" section near the bottom to see how the .csv file that's created is formatted.

If interested, there is also our "PCCS Admin Tool" (python based) that can take that resulting .csv file as input and do the work to download PCK Certs for you:

https://github.com/intel/SGXDataCenterAttestationPrimitives/tree/master/tools/PccsAdminTool

Regards.

Re: curl to get pck certificates

Kishore_B_Intel — Tue, 26 Mar 2024 01:41:17 GMT

Thank You for the information.

From what I understand, PCKRetrievalTool can only be used on the host machine, not on the VM. Is that correct?

If so, I cannot use this, because I am running on VMware OS/Hypervisor host, which does not have the support for the PCKRetrievalTool.

Since PCKRetrievalTool only supports Linux and Windows host.

I have the VM running on VMware OS/Hypervisor.

Is there any other way to get this?

Thank You in Advance.

Regards.

Re: curl to get pck certificates

Scott_R_Intel — Wed, 27 Mar 2024 18:53:41 GMT

Hello again.

You can actually run the PCK Cert ID retrieval tool in a guest to get the information you require. The only thing you won't be able to get is the platform manifest. This is only available to the host OS via UEFI variables.

Regards.