---
title: "Azure Confidential VM Attestation - Linux"
slug: "fortanix-ccm-azure-cvm-attestation-linux"
updated: 2026-07-22T14:15:21Z
published: 2026-07-22T14:15:21Z
canonical: "support.fortanix.com/fortanix-ccm-azure-cvm-attestation-linux"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Confidential VM Attestation - Linux

## 1.0 Introduction

This article describes the procedure for completing the attestation workflow for an Azure Confidential Virtual Machine (CVM) using Fortanix Confidential Computing Manager (CCM) in **Linux**-based environments.

After configuring the application and build in Fortanix CCM and registering the required Platform Configuration Register (PCR) values, the Azure CVM must run the Fortanix Attestation Client for Linux to establish trust and register itself as an approved compute instance.

## 2.0 Prerequisites

Before proceeding, ensure the following:

- Ensure to download the Fortanix Azure CVM Attestation Client binary from [*here*](https://fortanix.zendesk.com/hc/en-us/articles/46157910024084-Fortanix-CCM-Attestation-Client-Linux).
- The Azure CVM has been deployed and is accessible.
- A Fortanix CCM application and its associated build have been created and approved.
- PCR values collected from the Azure CVM environment have been mapped to the build in Fortanix CCM. *For more information on creating Azure VMs and performing PCR extraction, refer to* [*Azure Confidential VM Setup - Linux*](/v1/docs/azure-confidential-vm-setup-linux-1)*.*
- Network access exists between the Azure CVM and Fortanix CCM endpoint.
- You have access to the following configuration values:
  - Fortanix CCM tenant URL
  - Join token

> [!NOTE]
> NOTE
> 
> Attestation cannot proceed if the application build has not been approved in Fortanix CCM.

## 3.0 Configure Execution Permissions

Before configuring permissions, run the following command to make the `azure-cvm-attestation-client` file executable:

```bash
chmod +x ./ccm_attestation_client_azure_cvm_linux
```

The attestation client can run either as root or as a restricted user, depending on system configuration.

**Option 1: Run as root**

No additional configuration is required.

**Option 2: Run as non-root**

Run the following command to verify whether TPM devices are readable by non-root users:

```bash
stat -c%G /dev/tpmrm0
```

If the output indicates the resource belongs to the `tss` group, run the following command to add the current user to this group:

```bash
sudo usermod -aG tss $USER
```

> [!NOTE]
> NOTE
> 
> Log in again to apply the updated group membership.

## 4.0 Configure Environment Variables

The Fortanix Attestation Client uses the following environment variables:

> [!NOTE]
> NOTE
> 
> The `JOIN_TOKEN` is mandatory. Without it, the node will not register with Fortanix CCM.

| Environment Variable | Default Value | Description |
| --- | --- | --- |
| `RUST_LOG` | `ERROR` | Set to `DEBUG` to enable verbose logging. |
| `RUST_BACKTRACE` | `0` | Set to `1` to enable panic backtraces. |
| `MANAGER_ENDPOINT` | https://ccm.fortanix.com | Fortanix CCM service endpoint for attestation requests. |
| `JOIN_TOKEN` | `unset` | Must be set to the join token generated in Fortanix CCM. |

Example configuration:

```bash
export RUST_LOG=debug
export MANAGER_ENDPOINT=https://ccm. fortanix.com
export JOIN_TOKEN=cccccbrenhlrinntnlhubfuulnbfnnchrltbvcchbelc
```

## 5.0 Generate a Join Token

Perform the following steps to generate a join token in Fortanix CCM:

1. Log in to Fortanix Armor Platform. *For more information,* [*Getting Started with Fortanix Armor*](/v1/docs/fortanix-armor-getting-started)*.*
2. Navigate to the Fortanix CCM user interface (UI). *For more information, refer to* [*Fortanix Armor Solutions*](/v1/docs/fortanix-armor-solutions)*.*
3. In the CCM user interface (UI) left navigation panel, click **Infrastructure → COMPUTE NODES → Azure SEV Containers**, and then click **ADD NODE**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3882).png)

**Figure 1: Add node**
4. In the **Enroll Compute Node** window, click **COPY** to copy the Join Token. This Join Token is used by the compute node to authenticate itself.

## 6.0 Run the Attestation Client

Run the following command to execute the attestation client:

```bash
sudo -E ./ccm_attestation_client_azure_cvm_linux
```

> [!NOTE]
> NOTE
> 
> You can also set the environment variables and run the attestation client through a script.

Example script: `test.sh`

```bash
export RUST_LOG=debug
export MANAGER_ENDPOINT=https://ccm.fortanix.com  
export JOIN_TOKEN=<JOIN TOKEN VALUE>
sudo -E ./ccm_attestation_client_azure_cvm_linux
```

Run the script using the following command:

```bash
bash test.sh
```

The above script sets the environment variables.

The attestation process begins automatically. During this time, the client collects platform evidence, verifies signatures, and submits measurements to Fortanix CCM. The process may take several minutes, depending on the compute environment and network conditions.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/CVM Linux- 5.png)

**Figure 2: Evidence and certificate are fetched**

> [!NOTE]
> NOTE
> 
> Running the attestation client multiple times for the same build generates a new certificate each time. This allows users to obtain new certificates when previous ones expire.

## 7.0 Verify Attestation Status in Fortanix CCM

After the attestation client has completed execution, verify the attestation result in Fortanix CCM by confirming that the attestation certificate is available for download.

Perform the following steps to download the certificate:

1. Navigate to the Fortanix CCM UI. *For more information, refer to* [*Fortanix Armor Solutions*](/v1/docs/fortanix-armor-solutions)*.*
2. Navigate to **Applications** and select the Azure CVM application, then go to its detailed view and navigate to **CERTIFICATES** tab.
3. Click **DOWNLOAD CERTIFICATE** to verify its validity.

Attestation is considered successful when the attestation certificate appears and is available for download. This confirms that the hardware measurements match the PCR values configured for the build in Fortanix CCM.