ra_tls_verify_callback: sgx_qv_verify_quote failed: 57369

[tiagorvmartins]

Hello, we had correctly setup two enclaves communicating between each other over ra-tls,
However we started having these issue:

ra_tls_verify_callback: sgx_qv_verify_quote failed: 57369

Which I believe its related with the error SGX_QL_NETWORK_ERROR:
https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/6882afad8644c27db162b40994402c8ad2a7fb32/QuoteGeneration/quote_wrapper/common/inc/sgx_ql_lib_common.h#L76C5-L76C25

Any idea about why it started appearing?
It was working before and we didn't change anything at all on our code base the expected mrenclave/mrsigner are correct aswell,
Also during our tests, we notice this warnings (even when it was working before):

WARNING: The ra_tls_verify_callback_der() API is deprecated in favor of the ra_tls_verify_callback_extended_der() version of API.
WARNING: The collateral is out of date.

Any idea on what might be causing these issues?
Thank you!

[dimakuv]

Indeed, this error is SGX_QL_NETWORK_ERROR.

According to the following links:

• sgx_qe_get_target_info failed with SGX_QL_NETWORK_ERROR intel/SGXDataCenterAttestationPrimitives#147
• https://docs.edgeless.systems/marblerun/1.1/building-services/occlum#error-message-error-returned-from-the-p_sgx_get_quote_config-api
• https://download.01.org/intel-sgx/sgx-dcap/1.4/linux/docs/Intel_SGX_ECDSA_QuoteLibReference_DCAP_API.pdf

It's about "network connectivity problems". In particular, it's about the DCAP software infrastructure installed on your machine/cluster.

1. If you're using something like Microsoft Azure cloud (which has the DCAP software infrastructure baked in), then you need to check if Azure -- maybe there was some breaking update, and you need to install a new package or upgrade the existing one? (Or maybe there was an outage.)
2. If you're using your own machine, i.e. you installed DCAP software infrastructure yourself, then most likely you're using the PCCS service. Please check if PCCS service is alive and running, and doesn't have any network errors. Also, maybe you need to update the PCCS service, or update the certificates/collaterals it fetches from the Intel remote web-sites.

[dimakuv]

By the way, the two WARNINGs you see are more or less benign:

1. The first warning is benign, but you may want to upgrade to the newer API of Gramine in the future (if you wrote the app yourself).
2. The second warning is more serious, you may want to update the collateral (if you're using PCCS, it has different policies on how collateral is updated, like once a week, once a month, smth like that; you can also update the collateral manually by invoking a corresponding tool in PCCS).

[tiagorvmartins]

1. thank you, yes we will update accordingly
2. I am not sure if this is something is under our control, this is running on a k8s cluster where the sgx plugin was installed using a install plugin command:
   $ az aks addon update --addon confcom --name " ClusterName " --resource-group " ResourceGroup " --enable-sgxquotehelper

Do you have some idea on what should be done? Thank you!

[dimakuv]

Maybe @kailun-qin @llly or @mythi can help with this?

[kailun-qin]

I think this is a known issue, pls see some discussions here and some information here.

[tiagorvmartins]

Thank you @kailun-qin and @dimakuv , accepting the answer.