How to get certificates from Intel PCS without PCCS

[Kishore_B_Intel]

Hi,

Currently the way attestation works for me is that you install PCCS and run the attestation to get the certificates from Intel PCS via config file.

Something like below:

/opt/intel/sgx-dcap-pccs/config/default.json

    "uri": "https://sbx.api.trustedservices.intel.com/sgx/certification/v4/",

    "ApiKey" : "< Primary Key from https://sbx.api.portal.trustedservices.intel.com/manage-subscriptions>",

Is there a way to get the certificates directly from Intel PCS services without having the PCCS installed in our VM?

All the instructions I have seen are using PCCS mechanism only.

Are there any instructions documented to get the Certificates without PCCS?

Thanks

[Sirasapalli]

Were you able to download Certificate without using PCCS service ?

[Benny_Intel · Accepted solution]

Multiple ways for platform registration, also without PCCS, are described in the Intel TDX Enabling Guide. The trick is to create local caching files using the PCCS Admin tool. Additionally, activate local caching by setting local_cache_only to true in /etc/sgx_default_qcnl.conf.

[kartel]

You can interact directly with Intel PCS using their API without PCCS, but you'll need to handle the requests manually. The API key you mentioned is still required, and you'll need to use tools like curl custom scripts to send requests to Intel's certification service URL. Intel’s developer documentation might have more details on the endpoints and required parameters.