--- title: "Enroll a Compute Node (bare metal) - Intel TDX" slug: "fortanix-ccm-enroll-a-compute-node-bare-metal-intel-tdx" updated: 2026-07-24T15:26:54Z published: 2026-07-24T15:26:54Z canonical: "support.fortanix.com/fortanix-ccm-enroll-a-compute-node-bare-metal-intel-tdx" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Enroll a Compute Node (bare metal) - Intel TDX ## 1.0 Introduction This document describes how to enroll a compute node on a bare-metal **Intel TDX** platform in **Fortanix Confidential Computing Manager (CCM)**. ## 2.0 Enroll A Compute Node (bare Metal) – Intel TDX ### 2.1 Prerequisites - Ensure that you have completed all required CPU, GPU, and system configuration prerequisites as outlined in the [*NVIDIA Deployment Guide for Confidential Computing*](https://docs.nvidia.com/cc-deployment-guide-tdx.pdf). In particular, complete the following sections before enrolling the compute node: - **Hardware IT Administrator** → **Selecting Hardware** to verify that the platform hardware is supported. - **Hardware IT Administrator** → **Setting Up the Hardware and Configuring Your System** to configure the BIOS settings for Intel TDX and Confidential Computing. - **Host OS Administrator** → **Setting Up the Host OS** to install and configure the Intel TDX host software, including the required repositories, packages, and kernel. - **Host OS Administrator** → **Preparing the Host** to validate that the host is correctly configured for Intel TDX before deploying Confidential Computing workloads. - Check the "[***Secure AI Compatibility Matrix***](https://www.nvidia.com/en-us/data-center/solutions/confidential-computing/secure-ai-compatibility-matrix/)" to view the supported combinations of NVIDIA GPUs, VBIOS versions, CUDA driver versions, and Confidential Computing modes. - Ensure Simultaneous Multithreading (SMT) is disabled in the BIOS when using Intel TDX. If enabled, the Confidential Virtual Machine (CVM) launch may fail with `fw_error=7 'Policy is not allowed'` error. - Before enrolling an Intel TDX compute node, ensure that the Intel SGX Registration Agent service is installed and the platform is registered with Intel. For detailed instructions, refer to the following sections: - [*Section 2.2: Install Intel SGX Registration Agent Service*](/v1/docs/fortanix-ccm-enroll-a-compute-node-bare-metal-intel-tdx#22-install-intel-sgx-registration-agent-service) - [*Section 2.3: Automatic Platform Registration*](/v1/docs/fortanix-ccm-enroll-a-compute-node-bare-metal-intel-tdx#23-automatic-platform-registration) - [*Section 2.4: Manual Platform Registration*](/v1/docs/fortanix-ccm-enroll-a-compute-node-bare-metal-intel-tdx#24-manual-platform-registration) ### 2.2 Install Intel SGX Registration Agent Service The Intel SGX Registration Agent service is required to register the platform with Intel. Perform the following steps: 1. Run the following command to configure the Intel SGX package repository: ```bash wget -q https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key -O /tmp/intel-sgx.key sudo gpg --dearmor -o /usr/share/keyrings/intel-sgx-keyring.gpg /tmp/intel-sgx.key echo "deb [signed-by=/usr/share/keyrings/intel-sgx-keyring.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main" | sudo tee /etc/apt/sources.list.d/intel-sgx.list sudo apt-get update ``` 2. Run the following command to install the Intel SGX Registration Agent service: ```bash sudo apt-get install -y sgx-ra-service ``` 3. Run the following command to verify that the package is installed: ```bash dpkg -l | grep sgx-ra-service ``` ### 2.3 Automatic Platform Registration Use this procedure if the system BIOS supports Intel SGX Auto Multi-Package (MP) Registration. 1. Verify that SGX Auto MP Registration is enabled in the system BIOS. This setting allows the Intel Multi-Package Registration Agent (MPA) to automatically register the platform with Intel during system startup. By default, SGX Auto MP Registration is disabled, and the MPA does not automatically run at boot. 2. Reboot the system if you changed the BIOS setting. 3. Run the following command to verify that platform registration completed successfully by reviewing the MPA registration log: ```bash cat /var/log/mpa_registration.log ``` 4. Confirm that the MPA registration log contains either of the following successful registration messages: - `Registration Flow - PLATFORM_ESTABLISHMENT passed successfully` - `Registration Flow - TCB_RECOVERY passed successfully` *For more information about Intel SGX platform registration and the expected registration flow messages, refer to the “Infrastructure Setup” section of the* [*Intel® TDX Enabling Guide (Direct Registration)*](https://cc-enabling.trustedservices.intel.com/intel-tdx-enabling-guide/02/infrastructure_setup/#direct-registration). If the registration is unsuccessful, perform manual platform registration as described in [*2.4: Manual Platform Registration*](/v1/docs/fortanix-ccm-enroll-a-compute-node-bare-metal-intel-tdx#24-manual-platform-registration). ### 2.4 Manual Platform Registration Use this procedure if SGX Auto MP Registration is disabled. 1. Run the following command to generate a platform manifest: ```bash /opt/intel/sgx-ra-service/mpa_manage -get_platform_manifest platform_manifest ``` This command creates a file named `platform_manifest`. 2. Run the following command to register the platform with Intel: ```bash curl -H "Content-Type: application/octet-stream" \     -v \     --data-binary @platform_manifest \     -X POST "https://api.trustedservices.intel.com/sgx/registration/v1/platform" ``` 3. Verify that the request succeeds. A successful registration returns HTTP status code `201 Created` and displays the platform PPID. 4. Run the following command to verify that platform registration completed successfully: ```bash cat /var/log/mpa_registration.log ``` 5. Confirm that the MPA registration log contains either of the following successful registration messages: - `Registration Flow - PLATFORM_ESTABLISHMENT passed successfully` - `Registration Flow - TCB_RECOVERY passed successfully` *For more information about Intel SGX platform registration and the expected registration flow messages, refer to the “Infrastructure Setup” section of the* [*Intel® TDX Enabling Guide (Direct Registration)*](https://cc-enabling.trustedservices.intel.com/intel-tdx-enabling-guide/02/infrastructure_setup/#direct-registration). After completing either the Automatic Platform Registration or Manual Platform Registration procedure, continue with the Intel TDX node enrollment steps described in [*Section 2.5: Ubuntu 25.10 Node Agent*](/v1/docs/fortanix-ccm-enroll-a-compute-node-bare-metal-intel-tdx#22-ubuntu-2510-node-agent). ### 2.5 Ubuntu 25.10 Node Agent *Download the Ubuntu Node Agent installer from* [*here*](https://fortanix.zendesk.com/hc/en-us/articles/48858446031380-Fortanix-Node-Agent-Software-Intel-TDX-Platform)*.* Perform the following steps to enroll the Ubuntu 25.10 compute node: 1. Run the following commands to extract the contents of the `Node-Agent-installer.tar.gz` package and open the folder: ```bash tar -zxvf Node-Agent-Installer.tar.gz cd em-agent-installer-tdx ``` 2. Open the **INSTALLER_README.md** file containing the steps to enroll the compute node in Fortanix CCM. ![Text Description automatically generated with medium confidence](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-enroll-compute-nodes-on-bare-metal---intel-tdx-v2.0-image-ktlj9vqg.png) **Figure 1: Readme.txt** 3. Run the following command to execute the **installer.sh** script: ```bash sudo bash installer.sh ``` Where, `<join-token>` is the token copied from Fortanix CCM. *For more information, refer to Section 3.0: Generate a Join Token*. ## 3.0 Generate a Join Token Perform the following steps to generate a join token in Fortanix CCM: 1. Log in to Fortanix Armor Platform. *For more information, refer to* [*Getting Started with Fortanix Armor*](/v1/docs/fortanix-armor-getting-started)*.* 2. Navigate to the Fortanix CCM user interface (UI). *For more information, refer to* [*Fortanix Armor Solutions*](/v1/docs/fortanix-armor-solutions)*.* 3. In the CCM UI left navigation panel, click **Infrastructure → COMPUTE NODES → Intel TDX**, and then click **ADD NODE**. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image(148).png) **Figure 2: Add node** 4. In the **Enroll Compute Node** window, click **COPY** to copy the Join Token. This Join Token is used by the compute node to authenticate itself. ## 4.0 Validate the Enrolled Compute Node After the compute node is successfully enrolled, it appears in the **COMPUTE NODES** overview table in Fortanix CCM. Perform the following steps to debug the `em-agent` service: 1. Run the following command to view the logs: ```bash journalctl -xe | grep em-agent ``` 2. Run the following command to view the status of the `em-agent` service or check the system logs directly: ```bash systemctl status em-agent ```