How to locate the corresponding certificates

[aghia98]

Hi,
I successfully managed to run your code, specifically the "testQuoteV3OnChainAttestation()".
Now, I want to test it on my own generated quote. I guess that I should update tcbDer, rootCaDer, platformDer, platformCrlDer, rootCrlDer located in PCCSSetupBase.sol with the appropriate certificates.

I feel that I should use this Intel API to help me: https://api.portal.trustedservices.intel.com/content/documentation.html#pcs-certificate-v3
The rootCaDer is easilly found and corresponds to what is already hardcoded.
However, I am not sure how I should locate the other certificates.

Should I extract some values from my quote to query them ?
Can you give me an insight about which GET request I should use ?

Thank you in advance

[smilenow]

Before using the DCAP and onchain PCCS, you need to upsert the necessary collaterals to verify your quote. We released DCAP QPL tool to upsert the collaterals to the target PCCS smart contracts, basically it fetches the collaterals from either Azure PCCS or Intel PCS. And you can also follow the similar approach to fetch the collaterals from:

• Your local PCCS
• Cloud providers' PCCS
• Intel PCS

It depends on how you generate the quote, should use the same data source(PCCS) to keep consistency.

Basically, in order to verify a quote, you need:

• Root CA
• Platform CA / Processor CA (it's up to which type you're using)
• Signing CA
• Root CA CRL
• Platform CA CRL / Processor CA CRL (it's up to which type you're using)
• QE Identity v3 / QE Identity v4 (it's up to which type you're using)
• the TCB info which corresponds to your FMSPC in the quote

[preston4896]

Hey @aghia98 I apologize for the delayed response. I am assuming you intend to run testQuoteV3OnChainAttestation() in your local environment, rather than on a live network/testnet.

If this is the case, you most likely should only need to change the platformDer value in PCCSSetupBase.sol, which is the only value that you need to extract from your quote (platformDer is the DER-encoded format of the PCK leaf certificate found in your quote).

UPDATE: you do not need to update any values in PCCSSetupBase.sol unless your PCK is issued by Intel SGX PCK Processor CA, which requires changes to the platformDer and platformCrlDer values.

If the FMSPC value is different from what is provided in the sample, you would need to fetch those too from Intel API. The GET url to use for FMSPC SGX Quote V3 is https://api.trustedservices.intel.com/sgx/certification/v3/tcb?fmspc=FMSPC_GOES_HERE.

That being said, I highly recommend that you simply perform verifications directly on our testnet. P/S: No fees needed, you may pass 0 to msg.value.

If you are running issues due to missing collaterals, then I would suggest you to follow the steps as described by my colleague above.

And lastly, if you needed tokens on our testnet. Check out https://www.l2faucet.com/

Let me know if you have any further questions. :)