Error STATUS_SGX_CRL_UNKNOWN_ISSUER

Elod — Mon, 07 Apr 2025 11:15:29 GMT

Hi,

I am using AttestationApp from repository: https://github.com/intel/SGX-TDX-DCAP-QuoteVerificationLibrary/tree/v1.1.8180 and got this error:

$ LD_LIBRARY_PATH=./ ./AttestationApp --rootCaCrl=IntelSGXRootCA.der
Running QVL version: 1.0.0
Verification results: false

AppLogs:
PCK certificate chain verification failed with status: STATUS_SGX_CRL_UNKNOWN_ISSUER(29)
TCB info verification OK!
Quote verification failed with status: STATUS_INVALID_PCK_CRL(41)

Collateral data is collected from PCCS via its API, PCCS was provisioned with PCKIDRetrievalTool.

Note: I already found similar issue reported here and I have tested suggestions without no success.

Do you know what is causing the `STATUS_SGX_CRL_UNKNOWN_ISSUER` error and how I can fix it?

Thank you,
Elod

Re: Error STATUS_SGX_CRL_UNKNOWN_ISSUER

Elod — Thu, 10 Apr 2025 10:52:21 GMT

Solved my issue.

I was collecting pckCrl.der file from the wrong source.
Using the correct source, url from the pckCert\X509v3 CRL Distribution Points solved my issue.

topic Re: Error STATUS_SGX_CRL_UNKNOWN_ISSUER in Intel® Software Guard Extensions (Intel® SGX)

Error STATUS_SGX_CRL_UNKNOWN_ISSUER

Re: Error STATUS_SGX_CRL_UNKNOWN_ISSUER

Solved my issue.