attezt: device attestation, PKCS11 and ACME
attezt brings the IETF device-attest-01 ACME challenge and PKCS#11 attestation to Linux.
IETF is standardizing the device-attest-01 ACME challenge so organizations can provision device-bound certificates whose signing keys cannot be extracted from the intended machine. The Linux project attezt supplies an ACME client, an attestation server with simple inventory support, and a PKCS#11 agent. A 2026 All Systems Go talk explains the challenge and how the pieces support mTLS with strong device identity.
- device-attest-01 lets ACME issue non-exportable device-bound certificates.
- attezt includes an ACME client, attestation server, and PKCS#11 agent.
- Aimed at reverse proxies that need strong mTLS device identity.
Full article155 words · extracted from media.ccc.de · click to collapse
IETF is standardizing a new ACME challenge, `device-attest-01`, which allows organizations to provision device bound certificates to machines, and enables machines to present signing certificates that can't be extracted out of machines they where intended for. This is useful for cases where you want to provide reverse proxies with mTLS with a strong sense of device identity.
attezt is intended to be a suite of tools to work the new `device-attest-01` ACME challenges for Linux. It provides an ACME client, an attestation server with (simple) support for inventory systems and a PKCS11 agent which together enables the support of this ACME challenge on Linux.
This talk will give an introduction to the new ACME challenge, a quick rundown of how an attestation server works and how attezt works.
https://datatracker.ietf.org/doc/draft-ietf-acme-device-attest/
https://github.com/Foxboron/attezt
Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/
Download
Audio
Tags
Text extracted automatically; images, tables and formatting may be missing. Original: https://media.ccc.de/v/all-systems-go-2026-414-attezt-device-attestation-pkcs11-and-acme#t=30