PCS v4 pckcert/pckcerts HTTP 404 — cannot fill PCK cache (TDX attestation blocked)

[rahul-kr]

Hi,

Need help with Intel PCS for TDX attestation.

Host: virtlab2652-grr
OS: RHEL 9.9
Local PCCS + QGS are running. PCKIDRetrievalTool can collect platform IDs (no platform manifest / not multi-package).

Works:
- GET /sgx/certification/v4/pckcrl?ca=processor → HTTP 200

Fails:
- GET /sgx/certification/v4/pckcert → HTTP 404
- GET /sgx/certification/v4/pckcerts → HTTP 404
(empty body; local pckcache stays empty; attestation quote verify blocked)

Request-IDs:
- pckcert: 0110b3f6130a47a6b7f7f6cd85f55cc0
- pckcerts: c6a8732a17c7497ab363a850b285f68f

Platform:
- qeid: 5cea3354ba5b36b4b1ba36ba19f807f9
- pceid: 0000
- cpusvn: 07070a0a05ff00020000000000000000
- pcesvn: 1000

Why is PCK unavailable for this PPID/PCE-ID, and how can we enable pckcerts to return 200?

Thanks.

[Scott_R_Intel]

What CPU model are you running?  If you're trying to use TDX, it has to be a Xeon Scalable, and all Xeon Scalables have to be registered with our Intel Registration Service, even if you're only running a single CPU.  So, you will need to get the platform manifest.  To get the platform to generate new platform keys and a new platform manifest, you'll need to do an "SGX Factory Reset" in the BIOS and then again use the PCKIDRetrievalTool to get the platform manifest and use it to register the platform.

More info on platform registration can be found in our TDX Enabling Guide here.

Regards.