A high-level flow of Fortanix Confidential Computing Manager (CCM) usage is described below:
The user deploys Fortanix CCM.
Upon deployment, the backend enclaves obtain IAS attestation and use that to securely establish a highly available service cluster (in case of multi-node backend deployment).
The backend issues an X.509 certificate to each instance of the node agent if it can obtain a valid IAS attestation for the node. This flow is called node provisioning and happens only once for the lifecycle of the node agent process.
Node provisioning will happen automatically post-deployment.
The user now whitelists their enclaves (either from the UI or using the Fortanix CCM APIs) and then deploys them.
The application enclave communicates with the node agent to obtain a local attestation which the backend service verifies before issuing a TLS certificate. For enclaves deployed using EnclaveOS, this flow is automated and triggered using certificate-related manifest options.
The application enclave can also choose to provide periodic heartbeats signed from within the enclave for secure enclave monitoring. For EnclaveOS applications, this is triggered using the heartbeat-related options in the application manifest.
