• Registered: 2019-05-15
  • Posts: 23

Topic: Why can't vierify the certificate chain in sgx Enclave?

I want verify the certificates chain.and I write code to test the function. and I tested it success in common mode. but in sgx enclave failed. it occured when i executed the function which named wolfSSL_CertManagerVerifyBuffer. the info as flows:
failed (-150): ASN date error, current date before. how can i resolve this problem?thanks.

Share

  • From: Bozeman
  • Registered: 2017-07-06
  • Posts: 29

Re: Why can't vierify the certificate chain in sgx Enclave?

Hi zhq0918,

That error is reported when there are certificates not valid (yet), or if the date being used is incorrect. Can you verify that the device's set date and the enclave's set date are accurate or close to the current date?

Share

  • Registered: 2019-05-15
  • Posts: 23

Re: Why can't vierify the certificate chain in sgx Enclave?

Hi alex,
   I have checked my device's date, it is right,but how can i check the enclave's date?

Share

  • From: Bozeman
  • Registered: 2017-07-06
  • Posts: 29

Re: Why can't vierify the certificate chain in sgx Enclave?

Hi zhq0918,

There's a post on intel's forums (here: https://software.intel.com/en-us/forums … pic/742944) about using the function sgx_get_trusted_time, which may be what you're looking for with getting the enclave's time. Additionally, intel's documentation has the following information on the function as well: https://01.org/sites/default/files/docu … os_pdf.pdf. The function is documented on page 189.

Share

  • Registered: 2019-05-15
  • Posts: 23

Re: Why can't vierify the certificate chain in sgx Enclave?

Thank you @alex,I will try it.

Share