topic How to get certificates from Intel PCS without PCCS in Intel® Software Guard Extensions (Intel® SGX)

How to get certificates from Intel PCS without PCCS

Kishore_B_Intel — Sun, 31 Mar 2024 20:46:47 GMT

Hi,

Currently the way attestation works for me is that you install PCCS and run the attestation to get the certificates from Intel PCS via config file.

Something like below:

/opt/intel/sgx-dcap-pccs/config/default.json

"uri": "https://sbx.api.trustedservices.intel.com/sgx/certification/v4/",

"ApiKey" : "< Primary Key from https://sbx.api.portal.trustedservices.intel.com/manage-subscriptions>",

Is there a way to get the certificates directly from Intel PCS services without having the PCCS installed in our VM?

All the instructions I have seen are using PCCS mechanism only.

Are there any instructions documented to get the Certificates without PCCS?

Thanks

Re: How to get certificates from Intel PCS without PCCS

Sirasapalli — Tue, 26 Nov 2024 16:21:04 GMT

Were you able to download Certificate without using PCCS service ?

Re: How to get certificates from Intel PCS without PCCS

Benny_Intel — Fri, 13 Dec 2024 09:34:52 GMT

Multiple ways for platform registration, also without PCCS, are described in the Intel TDX Enabling Guide. The trick is to create local caching files using the PCCS Admin tool. Additionally, activate local caching by setting local_cache_only to true in /etc/sgx_default_qcnl.conf.

Re: How to get certificates from Intel PCS without PCCS

kartel — Tue, 14 Jan 2025 19:34:15 GMT

You can interact directly with Intel PCS using their API without PCCS, but you'll need to handle the requests manually. The API key you mentioned is still required, and you'll need to use tools like curl custom scripts to send requests to Intel's certification service URL. Intel’s developer documentation might have more details on the endpoints and required parameters.