{"guid":"23d6c6b3-8a6b-5a07-8531-d9bab98c051b","title":"attezt: device attestation, PKCS11 and ACME","subtitle":null,"slug":"all-systems-go-2026-414-attezt-device-attestation-pkcs11-and-acme","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/8XRBTA/","description":"IETF is standardizing a new ACME challenge, `device-attest-01`, which allows organizations to provision device bound certificates to machines, and enables machines to present signing certificates that can't be extracted out of machines they where intended for. This is useful for cases where you want to provide reverse proxies with mTLS with a strong sense of device identity.\n\nattezt is intended to be a suite of tools to work the new `device-attest-01` ACME challenges for Linux. It provides an ACME client, an attestation server with (simple) support for inventory systems and a PKCS11 agent which together enables the support of this ACME challenge on Linux.\n\nThis talk will give an introduction to the new ACME challenge, a quick rundown of how an attestation server works and how attezt works.\n\nhttps://datatracker.ietf.org/doc/draft-ietf-acme-device-attest/\nhttps://github.com/Foxboron/attezt\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Morten Linderud"],"view_count":192,"promoted":false,"date":"2026-09-30T10:15:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-09-30T23:30:09.502+02:00","tags":["414","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":1427,"duration":1427,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/414-23d6c6b3-8a6b-5a07-8531-d9bab98c051b.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/414-23d6c6b3-8a6b-5a07-8531-d9bab98c051b_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/414-23d6c6b3-8a6b-5a07-8531-d9bab98c051b.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/414-23d6c6b3-8a6b-5a07-8531-d9bab98c051b.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-414-attezt-device-attestation-pkcs11-and-acme","url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[],"recordings":[{"length":1427,"mime_type":"video/mp4","language":"eng","filename":"asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-30T11:54:01.365+02:00","label":"eng 1080p","size":121,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/h264-hd/asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_hd.mp4","url":"https://api.media.ccc.de/public/recordings/105543","event_url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1427,"mime_type":"video/webm;codecs=av01","language":"eng","filename":"asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_av1-sd.webm","state":"new","folder":"av1-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-30T12:11:09.188+02:00","label":"eng 576p","size":47,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/av1-sd/asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_av1-sd.webm","url":"https://api.media.ccc.de/public/recordings/105547","event_url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1427,"mime_type":"audio/mpeg","language":"eng","filename":"asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-30T12:11:12.904+02:00","label":"eng","size":22,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/mp3/asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/105548","event_url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1427,"mime_type":"audio/opus","language":"eng","filename":"asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-30T12:11:16.472+02:00","label":"eng","size":13,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/opus/asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_opus.opus","url":"https://api.media.ccc.de/public/recordings/105549","event_url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1427,"mime_type":"video/mp4","language":"eng","filename":"asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-30T12:11:20.821+02:00","label":"eng 576p","size":48,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/h264-sd/asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_sd.mp4","url":"https://api.media.ccc.de/public/recordings/105550","event_url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1427,"mime_type":"video/webm","language":"eng","filename":"asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-30T12:13:51.782+02:00","label":"eng 576p","size":57,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/webm-sd/asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/105551","event_url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1427,"mime_type":"video/webm;codecs=av01","language":"eng","filename":"asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_av1-hd.webm","state":"new","folder":"av1-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-30T12:17:24.176+02:00","label":"eng 1080p","size":111,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/av1-hd/asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_av1-hd.webm","url":"https://api.media.ccc.de/public/recordings/105552","event_url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1427,"mime_type":"video/webm","language":"eng","filename":"asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-30T12:21:28.598+02:00","label":"eng 1080p","size":134,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/webm-hd/asg2026-414-eng-attezt_device_attestation_PKCS11_and_ACME_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/105554","event_url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"}]}