Attestation and Verification

Every application deployed on the Privasys Platform is protected by hardware-based attestation. The Developer Platform provides an interactive attestation panel so you can inspect and verify your deployment without writing any code.

What is attestation?

Remote attestation lets a client confirm three things:

1. The hardware is genuine — the CPU is a real Intel SGX or TDX processor, verified by Intel's provisioning infrastructure.
2. The software is the expected version — the measurements (MRENCLAVE for SGX, RTMR registers for TDX) match a known-good build.
3. The connection is end-to-end encrypted — the TLS certificate is bound to the enclave identity, so there is no proxy or intermediary that can read the traffic.

This is achieved through RA-TLS (Remote Attestation TLS), which embeds a hardware-signed quote inside the TLS certificate.

Using the attestation panel

Each deployed application has an Attestation tab in the Developer Platform. The panel provides:

Certificate details

The certificate is self-signed because the enclave is its own root of trust — the trust chain goes through the hardware quote, not a traditional CA.

Quote data

The attestation quote is the hardware-signed evidence. The panel shows:

For SGX (WASM apps)

For TDX (Container apps)

Platform extensions (WASM)

For WASM applications, the RA-TLS certificate includes custom X.509 extensions under Privasys OIDs that describe the platform configuration:

Workload extensions (WASM)

Each deployed WASM application gets its own leaf certificate (selected via SNI) carrying per-app extensions:

This means the certificate attests not just the enclave, but the specific application running inside it. See the X.509 OID scheme for the full reference.

Verification actions

The attestation panel provides buttons to:

• Request fresh certificates — triggers a new RA-TLS handshake. Useful to confirm the enclave is still live and measurements have not changed.
• Challenge mode — sends a random nonce. The enclave signs the nonce with the RA-TLS certificate private key, proving that the quote and the TLS session are bound together. This defeats replay attacks.
• Download PEM — downloads the RA-TLS certificate for offline inspection or integration with verification tooling.
• View raw quote — shows the hex-encoded attestation quote for manual inspection.

Programmatic verification

Beyond the UI, you can verify attestation programmatically using the verification libraries, available for Python, Go, Rust, TypeScript, and C#:

• JavaScript / TypeScript — @privasys/ra-tls
• Go — github.com/Privasys/ratls-client-go/ratls

These libraries connect to your deployed application, validate the RA-TLS certificate, extract the quote, and verify it against Intel's root of trust.

Example verification flow:

1. Connect to the application endpoint over HTTPS
2. Extract the RA-TLS certificate from the TLS handshake
3. Parse the X.509 extensions to get the attestation quote
4. Verify the quote signature against Intel's provisioning certificate chain
5. Compare MRENCLAVE or RTMR values against expected measurements
6. (For WASM) compare the code hash extension against the expected build output

Next steps

• Verification libraries for client-side integration
• Deploy WASM to understand how code hashes are generated
• Deploy containers to understand TDX measurements