Migration to DCAP - Quote: verification failed with error SW_HARDENING_NEEDED

[Abhiroop]

After the final deprecation of EPID by Intel, I am migrating my application hosted on Azure to DCAP. I started with the simple ra-tls-mbedtls example. My original application was using Gramine - 1.3.1 and I see that in that tag as well the DCAP functionality is present.

I have installed the Azure DCAP library as follows:

wget https://packages.microsoft.com/ubuntu/18.04/prod/pool/main/a/az-dcap-client/az-dcap-client_1.12.0_amd64.deb
sudo dpkg -i az-dcap-client_1.12.0_amd64.deb
sudo systemctl restart aesmd

I was wondering, what other changes are needed to setup the DCAP infrastructure. When I try executing the ra-tls-mbedtls example, I get the following (particularly when the client is ran):

[ using default SGX-measurement verification callback (via RA_TLS_* environment variables) ]

  . Seeding the random number generator... ok
  . Connecting to tcp/localhost/4433... ok
  . Setting up the SSL/TLS structure... ok
  . Loading the CA root certificate ... ok
  . Installing RA-TLS callback ... ok
  . Performing the SSL/TLS handshake...Azure Quote Provider: libdcap_quoteprov.so [ERROR]: Could not retrieve environment variable for 'AZDCAP_DEBUG_LOG_LEVEL'
ra_tls_verify_callback: Quote: verification failed with error SW_HARDENING_NEEDED
 failed
  ! mbedtls_ssl_handshake returned -0x3000

Last error was: -12288 - X509 - A fatal error occurred, eg the chain is too long or the vrfy callback failed

Could someone kindly provide me with some guidance on what changes are needed to fix the above?

I found an issue raised by someone else (#900) that was solved using docker but I want to stick to my current setup. Thanks for the help!

[Abhiroop]

Sorry, I was able to solve this by setting the SW_HARDENING_NEEDED variable. The misleading part is [ERROR]: Could not retrieve environment variable for 'AZDCAP_DEBUG_LOG_LEVEL', which (as discussed elsewhere) should be a warning not an error.