DCAP version and collateral endpoints

[Neil_Cohen]

Hi

We are using DCAP version 1.16 on azure sgx machines.      

This week we started getting quote verification errors with error code 0xe001 for our enclaves.

We tested and it will be resolved if we upgrade to a newer DCAP library.

Are these endpoints no longer compatible with that version of the DCAP lib?

https://global.acccache.azure.net/sgx/certification/v4/

https://api.trustedservices.intel.com/sgx/certification/v4/

Thanks

Neil Cohen

[Benny_Intel]

Hallo Neil Cohen,

thank you for reporting this issues, we are currently investigating it.

Is it possible that you use Open Enclave?
Because a very similar issue was just reported in the project's repo (https://github.com/openenclave/openenclave/issues/5069) and already resolved with a recent PR (https://github.com/openenclave/openenclave/pull/5070).

Or do you see the issue using the DCAP library standalone?

Best regards,
Benny

[Neil_Cohen]

Hil. We don't use openenclave.  We use a rust wrapper on top of the intel sgx and dcap linux sdks.

It does work now that we upgraded the dcap libs to 1.23 from 1.16.  We are just trying to understand what changed and whether there was notice that we missed.  

Our sgx_default_qcnl.conf file contains

//PCCS server address

  "pccs_url": "https://global.acccache.azure.net/sgx/certification/v4/"

// PCK Certs and verification collateral will be retrieved using pccs_url 

  ,"collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/"

Thanks