search

apache / incubator-teaclave

Apache Teaclave (incubating) is an open source universal secure computing platform, making computation on privacy-sensitive data safe and simple.
https://teaclave.apache.org
Apache License 2.0
765 stars 158 forks source link

How to generate DCAP server cert and key? #663

Closed DCMMC closed 2 years ago

DCMMC commented 2 years ago

I'm going to deploy DCAP and there are some keys pre-generated by teaclave:

I could obtain PCK (Provisioning Certification Key) certifcate from Intel PCS (Provisioning Certification Service). But how can I generate the DCAP server certificate and key files which signed by PCK? From documents provided by Intel, it seems that I can obtain the Attestation Key from PCE (Provisioning Certification Enclave) through CertifyKey API.

Could you please give us a simple demo how can we generate the certificate and the key? Thanks a lot.

BTW, I found that dcap_root_ca_cert.pem is a self-signed Root CA by Teaclave. So are both dcap_server_key.pem and dcap_server_cert.pem signed by this dcap_root_ca_cert.pem instead of Intel's trusted Root CA? I guess this can only be used for test purpose. And it is an invalid certificate chain anchored by Intel's Root CA as shown in the step 4 in the below figure.

image
henrysun007 commented 2 years ago

As described in README.md, the DCAP service is a reference implementation of data center attestation service. It is an infrastructure for the datacenter and cloud (private or public), who I think should maintain the DCAP certificate chain. The credentials under keys/ are for demonstration and should not be used in production.