Closed agrawalprash closed 4 years ago
Hi Prashant,
Seems that the problem is that the client system is unable to be EPID provisioned since its sitting behind a proxy.
I see that you configured /etc/aesmd.conf to use "manual" proxy, and I also assume that you set the "aesm proxy =" to your actual proxy and port?
Once you have changed the configuration, you will need to restart AESMD for the settings to take effect.
If you are still having trouble after that, set DEBUG = 1 and VERBOSE = 1 in the settings file and run again. Then check the client.log file for more details.
cheers,
Dan
I did set "aesm proxy = http://proxyserver:port" in /etc/aesmd.conf, and I did restart the aesmd service, but nothing changed.
Interestingly, I got the platform provisioned once through a direct network connection (without proxy), after which all subsequent attestations have been working fine through the regular proxy network. So I'm curious if it's the provisioning step which runs into problems with proxy? I think my issue is similar to https://github.com/intel/linux-sgx/issues/190, but the root cause of that issue isn't clear either.
A system doesn't provision an EPID key until it attempts its first attestation. AESM needs to be able to connect to the internet in order to obtain the provisioning key. It won't need to re-provision, however, unless there's a TCB update, which can happen as a result of a BIOS update (as new microcode patches get pushed to the system).
The only thing I can think of that would make a difference here would be the proxy, possibly preventing you from contacting the provisioning service. The only way to know for sure would be to run tcpdump on the client and watch the connections from the client when it attempts attestation.
Closing since it's been over 6 months since the last comment.
Hi,
I'm trying to execute the run-server and run-client scripts for remote attestation. I copied the SPID, IAS_PRIMARY_SUBSCRIPTION_KEY and IAS_SECONDARY_SUBSCRIPTION_KEY from the API portal, and pointed IAS_REPORT_SIGNING_CA_FILE to the certificate file downloaded from here: https://software.intel.com/en-us/forums/intel-software-guard-extensions-intel-sgx/topic/814779#comment-1943218
I'm getting the following error on the server side:
and the following error on the client side:
Digging deeper, I see the following error in the aesmd logs at /var/opt/aesmd/data/internal_log.txt:
From above, it looks like the aesmd service tries to send a message to http://ps.sgx.trustedservices.intel.com:80 but gets an HTTP response code 417. I am behind a proxy, and I have configured it to be "manual" in /etc/aesmd.conf.
Any help on what might be happening or pointers to debug this further?
Thanks, Prashant