QuoteGenerationSample fails with 0xe011 for OVH scale-i1 machine
After many successful installs of our SGX applications, we're currently struggling on a newly setup dedicated server at OVH:
This samplecode of isnt working:
SGXDataCenterAttestationPrimitives/SampleCode/QuoteGenerationSample
git checkout dcap_1.22_reproducible
make
./app
[APP] Info: sgx_qe_set_enclave_load_policy is valid in in-proc mode only and it is optional: the default enclave load policy is persistent
[APP] Info: set the enclave load policy as persistent
[APP] Step1: Call sgx_qe_get_target_info:
[QPL] Error: No certificate data for this platform.
[get_platform_quote_cert_data ../qe_logic.cpp:388] Error returned from the p_sgx_get_quote_config API. 0xe011
Error in sgx_qe_get_target_info. 0xe011
This is the Hardware Spec:
* CPU: Intel Xeon Gold 6426Y - 16c/32t - 2.5 GHz/4.1 GHz
* Motherboard: SPC741D8QM3-NL-E (single socket)
* BIOS Date: 8/5/24
System Setup
* ubuntu 22.04
* Intel SGX SDK 2.20, DCAP 1.22
We tried bypassing our PCCS server in case of caching issues, but our issue is consistent, we get 404 not found. the same request works for other machines we operate (different specs):
curl -v -X GET "https://api.trustedservices.intel.com/sgx/certification/v4/pckcert?qeid=A7B644AED4D27CF028FECE9830F9A992&encrypted_ppid=4E0E877F6F86AC4D907040D1813BFDE55EE75A9FC793D6CF2F82301FDAC88FA001051E53DE451433D17D6BC8BE432143DBA5314BEDCBF9CFEE1F72DD37C9A52D5322A934723F565ECF296EFC0326EBB7403ED277401B887674E9EAA81C3A828170D2BAC34D6D336D66D9D176C2D08309F9C400CB576BCBC541CD1C416CE5DDDE2B1450B60BE035EC6D3743B848790FE10ED79FB02542661F77664890B0B4358015305EBCE89CBFBF60B4B4B237ECA50328F9728A691772608E9222E726B2267585D45D37ABF4E33A41903F7E82B1474A1AFE7C67F82F24B9DD3CCFD996B67EDBC1EC00FFB453BA808093BA1B95ED173ED5C87BB5BA6234C186813F2838F3806C29526AFEFC1B8DA8D99D3F25EE21F8DF5AF29DA644C33A1A24CD9A9CEB3ED0321614B03BAA7CF0BC29CA7650216AD2DDF4AD94723430D35887C8FF91F68375E6B701F0DC1BB7A061D328162483076C63E6CA5065FA1E433DC781ED893692A1269B9FB324FE2ABA9B2EBE2FA66CBFF1DF573B92AD15A72226DDF7E1107DD1F66A&cpusvn=0303191B04FF01030000000000000000&pcesvn=1000&pceid=0000" -H "Ocp-Apim-Subscription-Key: ********************"
Note: Unnecessary use of -X or --request, GET is already inferred.
* Trying 4.255.75.174:443...
* Connected to api.trustedservices.intel.com (4.255.75.174) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: C=US; ST=California; O=Intel Corporation; CN=api.trustedservices.intel.com
* start date: Oct 3 00:00:00 2024 GMT
* expire date: Jan 1 23:59:59 2025 GMT
* subjectAltName: host "api.trustedservices.intel.com" matched cert's "api.trustedservices.intel.com"
* issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Organization Validation Secure Server CA
* SSL certificate verify ok.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET /sgx/certification/v4/pckcert?qeid=A7B644AED4D27CF028FECE9830F9A992&encrypted_ppid=4E0E877F6F86AC4D907040D1813BFDE55EE75A9FC793D6CF2F82301FDAC88FA001051E53DE451433D17D6BC8BE432143DBA5314BEDCBF9CFEE1F72DD37C9A52D5322A934723F565ECF296EFC0326EBB7403ED277401B887674E9EAA81C3A828170D2BAC34D6D336D66D9D176C2D08309F9C400CB576BCBC541CD1C416CE5DDDE2B1450B60BE035EC6D3743B848790FE10ED79FB02542661F77664890B0B4358015305EBCE89CBFBF60B4B4B237ECA50328F9728A691772608E9222E726B2267585D45D37ABF4E33A41903F7E82B1474A1AFE7C67F82F24B9DD3CCFD996B67EDBC1EC00FFB453BA808093BA1B95ED173ED5C87BB5BA6234C186813F2838F3806C29526AFEFC1B8DA8D99D3F25EE21F8DF5AF29DA644C33A1A24CD9A9CEB3ED0321614B03BAA7CF0BC29CA7650216AD2DDF4AD94723430D35887C8FF91F68375E6B701F0DC1BB7A061D328162483076C63E6CA5065FA1E433DC781ED893692A1269B9FB324FE2ABA9B2EBE2FA66CBFF1DF573B92AD15A72226DDF7E1107DD1F66A&cpusvn=0303191B04FF01030000000000000000&pcesvn=1000&pceid=0000 HTTP/1.1
> Host: api.trustedservices.intel.com
> User-Agent: curl/7.81.0
> Accept: */*
> Ocp-Apim-Subscription-Key: ********************
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< Content-Length: 0
< Request-ID: fe5ac4cc3b524124b9c8629481ed14db
< Date: Tue, 10 Dec 2024 08:26:55 GMT
<
* Connection #0 to host api.trustedservices.intel.com left intact
Here's the output of the fortanix tool:
sudo ./sgx-detect
Detecting SGX, this may take a minute...
✔ SGX instruction set
✔ CPU support
✔ CPU configuration
✔ Enclave attributes
✔ Enclave Page Cache
SGX features
✔ SGX2 ✔ EXINFO ✘ ENCLV ✘ OVERSUB ✔ KSS
Total EPC size: 2.0GiB (no integrity protection)
✔ Flexible launch control
✔ CPU support
✔ CPU configuration
✔ Able to launch production mode enclave
✘ SGX system software
✔ SGX kernel device (/dev/sgx_enclave)
✔ libsgx_enclave_common
✔ AESM service
✘ Able to launch enclaves
✘ Debug mode
✔ Production mode
🕮 SGX system software > Able to launch enclaves > Debug mode
The enclave could not be launched.