attezt: device attestation, PKCS11 and ACME
asg2026-eng GaleriePlaylists: 'asg2026' videos starting here/ audio
- 23 min
- 2026-09-30
- 72
- Fahrplan
- AV1
- MP4
- WebM
IETF is standardizing a new ACME challenge, \`device-attest-01\`, which allows organizations to provision device bound certificates to machines, and enables machines to present signing certificates that can't be extracted out of machines they where intended for. This is useful for cases where you want to provide reverse proxies with mTLS with a strong sense of device identity.
attezt is intended to be a suite of tools to work the new \`device-attest-01\` ACME challenges for Linux. It provides an ACME client, an attestation server with (simple) support for inventory systems and a PKCS11 agent which together enables the support of this ACME challenge on Linux.
This talk will give an introduction to the new ACME challenge, a quick rundown of how an attestation server works and how attezt works.
https://datatracker.ietf.org/doc/draft-ietf-acme-device-attest/ https://github.com/Foxboron/attezt
Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/
Download
#### Video
#### Audio