Skip to content

ACME Remote Attestation & Device Attestation Challenges — draft-ietf-acme-rats, draft-ietf-acme-device-attest#

IETF 122 (Bangkok) digest Program Adjacent pick Bangkok · 15–21 March 2025

Slides Session recording Materials

  • Tier: Adjacent
  • Why: Shows the RATS attestation stack (Core, above) landing in a concrete consumer: certificate issuance gated on proof of device/hardware state, not just domain-control validation. Relevant to any automated cert-issuance pipeline for devices or workloads.
  • What: acme-rats lets an ACME server challenge a client to provide RATS-framework Evidence, Endorsements, or Attestation Results (via CMW) before issuing a certificate, optionally requesting specific claims. device-attest specifies identifiers and a challenge for validating a device's identity via attestation, with an update enabling a privacy-preserving identifier mode. (from abstract only)
  • How: The ACME challenge-response flow is extended so "prove domain control" can be replaced or supplemented by "prove device/platform integrity" using the same Evidence/Verifier machinery RATS defines generally.
  • Where applicable: IoT and managed-device fleets doing automated certificate issuance/renewal where hardware-backed proof of state matters more than pure domain ownership.