Troubleshooting

Fatal error: attestation failed

You may see an error like the following:

Started remote attestation with APM: <URL>
Running command /anjuna-az-attestation attest --config /tmp/measured-config.yaml --output-secrets attested-config.yaml
Fatal error: attestation failed: command /anjuna-az-attestation attest failed: exit status 1

This error indicates that the Anjuna Confidential Container failed to perform attestation to fetch secrets from the Anjuna Policy Manager (APM).

Check your APM secrets, APM policies, and Anjuna Confidential Container configuration to ensure that the secrets exist and the policies allow the Anjuna Confidential Container to access them.

SEV-SNP attestation fails on certificate revocation

The APM checks the SEV-SNP certificate chain against a CRL during attestation (see AMD SEV-SNP certificate revocation). Attestation may fail with one of the following errors:

  • no CRL is cached: In local mode, no CRL has been supplied for the host’s product line. Supply one, or set sevsnp-crl-source=amd-kds.

  • cached CRL is stale: The cached CRL has passed its nextUpdate time or the configured sevsnp-crl-max-age. Write a current CRL, or relax sevsnp-crl-max-age.

If you cannot supply or fetch a current CRL immediately and need to restore attestation in the meantime, you can suspend revocation checking for a bounded period as an emergency measure. See Temporarily disabling revocation checking in the Attestation verification configuration section above.