---
title: "Create an Image"
slug: "users-guide-create-an-image-1"
updated: 2026-06-26T16:26:32Z
published: 2026-06-26T16:26:32Z
canonical: "support.fortanix.com/users-guide-create-an-image-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an Image

## 1.0 Introduction

This article describes the steps to create an application image in the Fortanix Confidential Computing Manager (CCM). The users are provided the ability to quickly and easily navigate the interface to run containerized applications accordingly.

A Fortanix CCM image is a particular software release or a version of an application. Each image is associated with one enclave hash (MRENCLAVE).

When an image is first created in Fortanix CCM, it is in an unapproved state. After configurable approval actions are taken, the image is considered approved. When an image is approved, Fortanix CCM knows that enclaves with the associated hash (MRENCLAVE) are trusted instances of the corresponding application, and will issue certs with the application’s domain name(s) to those enclaves.

## 2.0 Prerequisites

Ensure the following:

- For Enclave OS (Operating System) applications - the Tag of the Docker image for the application.
- For Enclave Development Platform (EDP) applications - the `sigstruct.bin` file which is used to register the enclave with Fortanix CCM.
- For Azure Container Instances (ACI) applications - the Tag of the Docker image for the application.
- For Azure Confidential Virtual Machine (CVM) applications - a Confidential VM is created in Azure, and the Fortanix attestation agent runs on it.
- For Intel TDX applications - access to a system that supports Intel® Trust Domain Extensions (TDX) and the required attestation measurements for the workload are available.
- For Advanced Micro Devices (AMD) Secure Encrypted Virtualization (SEV) – Secure Nested Paging (SNP) applications – access to a system that supports AMD SEV-SNP and the required attestation measurements for the workload.

## 3.0 Create an Image

This section describes how to create an application image for different application types supported by Fortanix CCM.

An application image defines the trusted workload configuration that Fortanix CCM builds, verifies, and approves before deployment.

### 3.1 Enclave OS Applications

Before creating the image, ensure that you have created an Enclave OS application as mentioned in [*Add and Edit an Application*](https://support.fortanix.com/docs/users-guide-add-and-edit-an-application-1#40-add-enclave-os-application).

Perform the following steps to create an image for the Enclave OS application:

1. Navigate to the **Applications** menu item in the CCM UI left navigation panel and select the required Enclave OS application for which you want to configure an application image.
2. On the following page, click **+ ADD IMAGE** to configure the image of the Enclave OS application.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3182)(1).png)

**Figure 1: Images tab for the selected Enclave OS application**
3. On the **Image** form:
  1. In the **Image Type** section, the **AWS Nitro Enclaves** is selected by default.
  2. In the **Input image name** section, add the required tag name.
  3. In the **Output image name** section, add the required tag name and enter the **REGISTRY CREDENTIALS**. Here, the registry credentials are the credentials needed to access the private Docker registry where the image will be pushed. Since the input image is stored in a public registry, there is no need to provide credentials for the input image.
    - If you have added a registry in a particular account as described in [*Image Registry*](/v1/docs/users-guide-image-registry-1), then **Use same credential as input image registry** check box will be selected by default and the registry names for the output image will be filled automatically in the **Add Registry Credentials** fields.
    - If you have not saved any Registry Credentials, then manually enter the registry credentials for the **Output image name**.
  4. In the **Enclave Parameters** section,

> [!NOTE]
> NOTE
> 
> The Memory size and CPU count can be overridden at runtime with the following environment variables:
> 
> - `MEM_SIZE`
> - `CPU_COUNT`
    - **Memory size -** Select the memory size from the drop down to change the memory size of the Nitro.
    - **CPU count** - CPU count is the number of CPUs dedicated to an enclave out of all the CPUs available to the host machine.
    - **File persistence** – This check box is selected by default. This feature allows you to save the filesystem changes to an encrypted container mount. It allows the Nitro system to access a managed Security-object in Fortanix DSM to be able to encrypt and decrypt the Linux Unified Key Setup (LUKS) overlay file system. *For more information, refer to* [*AWS Nitro File Persistence*](/v1/docs/users-guide-aws-nitro-file-persistence-1)*.*

> [!NOTE]
> NOTE
> 
> For the File Persistence feature to work, you **must** configure the app certificate since when a Nitro image runs, it must be configured ahead of time to receive a certificate, which will authorize access to Fortanix DSM to obtain the keys for the Linux Unified Key Setup (LUKS) volume. Without the app certificate, this feature will not work.
4. Click **SAVE** to create the image.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3223)(1).png)

**Figure 2: Add Image form for the Enclave OS application**
5. An image approval task is created and added which is visible on the **Tasks** page. You can approve the task to approve the application image.

*For more information on how to approve the application image tasks for the Enclave OS application, refer to* [*Domain and Application Image Approval*](/v1/docs/users-guide-domain-and-application-image-approval-1)*.*
6. After it is approved, a green tick will appear in the **Approval status** column for that image.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3229).png)

**Figure 3: Approved Enclave OS application image**

> [!NOTE]
> NOTE
> 
> The **Source Image** tag and **Output Image** tag are optional fields and by default, the tag value is “latest” internally. If the user is entering a different tag value, then it can either be different values or the same. Once an image of an application is created, it will be pushed to the specified location in the **Output Image Name** of the application.

### 3.2 EDP Applications

Ensure that you have created an EDP application as mentioned in [*Add and Edit an Application*](https://support.fortanix.com/docs/users-guide-add-and-edit-an-application-1#50-add-edp-application).

Perform the following steps to create an image for the EDP application:

1. Navigate to the **Applications** menu item in the CCM UI left navigation panel and select the required EDP application for which you want to configure an application image.
2. On the following page, click **+ ADD IMAGE** to configure the image of the EDP application.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3230).png)

**Figure 4: Images tab for the selected EDP application**
3. On the **Image** form:
  1. **Image Version:** Enter the version of the image.
  2. **Image Type:** Select **Intel SGX** or **AWS Nitro Enclaves** as the platform. If you select the Image Type as **Intel SGX**, you must add the Sigstruct details. The SIGSTRUCT for an enclave is generated when an application is signed. It is used to register the enclave with Fortanix Confidential Computing Manager.

If you select the Image Type as **AWS Nitro Enclaves**, you have to add the Enclave Configuration JSON details which are unique enclave measurements that include a series of Hashes and Platform. The JSON measurements for an enclave are generated when an application is signed. It is used to register the enclave with Fortanix Confidential Computing Manager.
    - **Enclave Configuration SIGSTRUCT**: Three options are available to add SIGSTRUCT:
      - **Upload Enclave SIGSTRUCT**: To upload an enclave `sigstruct.bin` file, click **UPLOAD** as shown in **Figure 6**. Here is a sample [sigstruct.bin](https://fortanix.atlassian.net/wiki/download/attachments/1215889477/sigstruct.bin?version=1&modificationDate=1592252590269&cacheVersion=1&api=v2) file. **OR**
      - **Paste Base64-encoded Enclave SIGSTRUCT**: You can also paste a Base64-encoded SIGSTRUCT binary in the text box provided. **OR**
      - **Enter** **Enclave SIGSTRUCT Parameters**: Enter the following parameters: ⁃**MRENCLAVE:** This is the identity or hash of the enclave. ⁃**MRSIGNER:** This is the identity of the signer of the enclave. ⁃**ISVPRODID:** This is the numeric product identifier to be assigned to the enclave. Choose a unique value in the range 0-65535 for each application. ⁃**ISVSVN:** This is the numeric security version to be assigned to the enclave. Increment this value when a security-relevant change is made to the application.

> [!NOTE]
> NOTE
> 
> The **Enclave SIGSTRUCT Parameters** section is automatically filled when you either upload a `sigstruct.bin` file or paste a base64 encoded enclave SIGSTRUCT.
    - **Enclave Configuration JSON:** Three options are available to add measurements:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3236).png)

**Figure 5: Add Image form for the Intel SGX platform**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3233).png)

**Figure 6: Add Image form for the AWS Nitro Enclaves platform**
      - **Upload Measurement JSON**: To upload an enclave `measurement.json` file, click **UPLOAD** as shown in **Figure 7**. **OR**
      - **Paste Measurement JSON**: You can also paste the JSON enclave measurements in the text box provided. **OR**
      - **Enter Measurement**: Enter the following parameters: ⁃**PCR0**: This is the hash of the enclave image file. ⁃**PCR1**: This is the hash of the Linux kernel and bootstrap. ⁃**PCR2**: This is the Hash of the user application.

> [!NOTE]
> NOTE
> 
> The **Enter Measurement** section is automatically filled when you either upload a `measurement.json` file or paste the JSON enclave measurements.
4. Click **SAVE** to create the EDP application image.
5. An image approval task is created and added, which is visible on the **Tasks** page. You can approve the task to approve the image. *For more information on how to approve the application image tasks for the EDP application, refer to* [*Domain and Application Image Approval*](/v1/docs/users-guide-domain-and-application-image-approval-1)*.*
6. After the image is approved, a green tick will appear in the **Approval status** column for that image.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3244).png)

**Figure 7: Approved EDP application image**

### 3.3 ACI Applications

Ensure that you have created an ACI application as mentioned in [*Add and Edit an Application*](https://support.fortanix.com/docs/users-guide-add-and-edit-an-application-1#60-add-aci-application).

Perform the following steps to create an image for the ACI application:

1. Navigate to the **Applications** menu item from the CCM UI left navigation panel and select the required ACI application for which you want to configure an application image.
2. On the following page, click **+ ADD IMAGE** to configure the image of the ACI application.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3245).png)

**Figure 8: Images tab for the selected ACI application**
3. On the **Image** form:
  1. **Tag:** Enter the tag value of the docker image.

> [!WARNING]
> WARNING
> 
> If an image of an existing ACI application already has the same tag value as the current ACI application image, then it will give an error. Use a new tag value.
  2. **Add Registry Credentials:** Enter the **REGISTRY CREDENTIALS** for the **Input image name**. Here, the registry credentials are the credentials needed to access the private docker registry where the image will be pulled. Since the input image is stored in a public registry, there is no need to provide credentials for the input image.

> [!NOTE]
> NOTE
> 
> If a registry credential is given, then the image name must have a domain. For example, if the image is from Docker Hub, then the domain prefix is not required. However, if a registry credential is given, then the image name must start with `docker.io/` or similar.
    - If you have added a registry in a particular account as described in the article [*Image Registry*](/v1/docs/users-guide-image-registry-1) of Fortanix CCM, then the **Use saved credentials** check box will be selected by default.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3246).png)

**Figure 9: Add Image form for the ACI application**
  3. **Advanced Settings:** It is recommended to always select the **Wait for node registration to begin** check box unless the application has special requirements. Selecting this check box does not allow the execution before the Fortanix ACI node agent has retrieved the signed app certificate from the Fortanix CCM backend cluster.
    - **CPU Count:** Enter the number of CPU cores. By default, the value is **1**.
    - **Memory in GB:** Enter the amount of required RAM in GB units. By default, the value is **1**.
4. Click **GENERATE SECURE POLICY** to initiate the build of the JSON Fortifier template, which is used to deploy the confidential ACI container group.

> [!NOTE]
> NOTE
> 
> The creation of an application image may take up to a few minutes.
5. An image approval task is created and added, which is visible on the **Tasks** page. You can approve the task to approve the image. *For more information on how to approve the application image tasks for the ACI application, refer to* [*Domain and Application Image Approval*](/v1/docs/users-guide-domain-and-application-image-approval-1)*.*
6. After the image is approved, a green tick will appear in the **Approval status** column for that image.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3229) - Copy.png)

**Figure 10: Approved ACI application image**

#### 3.3.1 Deploy the ACI Application Using Azure Portal

Perform the following steps to deploy the application image to Fortanix ACI either through the Azure Portal or with the Azure CLI:

1. Navigate to the **Applications** → **Image** menu item and select the required image from the list.
2. Click the **POLICY** tab to view the JSON Azure Resource Manager (ARM) template encoding of the security policy generated earlier in [*Section 5.0: Create an Image for ACI Application*](/v1/docs/users-guide-create-an-image-1#50-create-image-for-aci-application)*.*

![DeployACI.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/21628983846420.png)

**Figure 11: Generated ARM template for the ACI security policy**
3. Click **DOWNLOAD** to save the ARM template for the deployment procedure.

*For more information on how to deploy an ACI application, refer to* [*Deploying the ACI Application Using Azure Portal*](/v1/docs/users-guide-deploying-the-aci-application-using-azure-portal-1)*.*

### 3.4 Intel TDX Applications

*Ensure that you have created an Intel TDX application as mentioned in* [*Add and Edit an Application*](/v1/docs/users-guide-create-an-image-1#35-azure-confidential-virtual-machine-cvm-applications)*.*

Perform the following steps to create an image for the Intel TDX application:

1. Navigate to the **Applications** menu item from the CCM UI left navigation panel and select the required Intel TDX application for which you want to configure an application image.
2. On the following page, click **+ ADD IMAGE** to configure the image of the Intel TDX application.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3530).png)

**Figure 12: Add Image option for the Intel TDX application**
3. On the **Image** form:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3531).png)

**Figure 13: Add image form for the Intel TDX application**
  1. **Image Version**: Enter a unique tag for the image.
  2. In the **Secure VM attributes** section,
    1. **MRTD**: Enter the platform-specific attestation measurement value associated with the secure image as copied in *Section 10.0: Calculate Image Measurements* of *Run and Create Intel TDX Application*.
    2. **RTMR**: Enter the Runtime Measurement Register values in **RTMR0**, **RTMR1**, **RTMR2**, and **RTMR3** fields.
  3. **Coprocessors**: Select an option to configure the NVIDIA Graphics Processing Unit (GPU) attestation setting:
    1. **Ignored**: The virtual machine (VM) must have a GPU, and the attestation agent collects GPU attestation data, but Fortanix CCM does not validate this attestation, it only checks that GPU attestation data is present. The actual attestation result is ignored during verification.
    2. **Required**: The VM must have a GPU, and the attestation agent collects GPU attestation data, and Fortanix CCM validates this data using NVIDIA Remote Attestation Service (NRAS).
4. Click **SAVE** to create the image.
5. An image approval task is created and added, which is visible on the **Tasks** page. You can approve the task to approve the image.

*For more information on how to approve the application image tasks for the Intel TDX application, refer to* [*Domain and Application Image Approval*](/v1/docs/users-guide-domain-and-application-image-approval-1)*.*
6. After the image is approved, a green tick will appear in the **Approval status** column for that image.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3534).png)

**Figure 14: Approved Intel TDX application image**

### 3.5 AMD SEV-SNP Applications

*Ensure that you have created an AMD SEV-SNP application as mentioned in* [*Add and Edit an Application*](/v1/docs/users-guide-add-and-edit-an-application-1#70-add-amd-sevsnp-application)*.*

Perform the following steps to create an image for the AMD SEV-SNP application:

1. Navigate to the **Applications** menu item from the CCM UI left navigation panel and select the required ADM SEV-SNP application for which you want to configure an application image.
2. On the following page, click **+ ADD IMAGE** to configure the image of the ACI application.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3135) - Copy.png)

**Figure 15: Add Image option for the AMD SEV-SNP application**
3. On the **Image** form:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Image-Create(1).png)

**Figure 16: Add image form for the AMD SEV-SNP application**
  1. **Image Version**: Enter a unique tag for the image.
  2. In the **Secure VM attestation** section,
    1. **Measurement**: Enter the platform specific attestation measurement value associated with the secure image as copied in *Section 10.0: Calculate Image Measurements* of [*Deploy Confidential VM Applications on AMD SEV-SNP Using Fortanix CCM*](/v1/docs/create-and-run-amd-sev-snp-application).
    2. **VMPL**: Select the **VMPL0**, **VMPL1**, **VMPL2**, or **VMPL3** as Virtual Machine Privilege Level.
  3. **Coprocessors**: Select an option to configure the NVIDIA Graphics Processing Unit (GPU) attestation setting:
    1. **Ignored**: The virtual machine (VM) must have a GPU, and the attestation agent collects GPU attestation data, but Fortanix CCM does not validate this attestation, it only checks that GPU attestation data is present. The actual attestation result is ignored during verification.
    2. **Required**: The VM must have a GPU, and the attestation agent collects GPU attestation data, and Fortanix CCM validates this data using NVIDIA Remote Attestation Service (NRAS).
4. Click **SAVE** to create the image.
5. An image approval task is created and added, which is visible on the **Tasks** page. You can approve the task to approve the image.

*For more information on how to approve the application image tasks for the AMD SEV-SNP application, refer to* [*Domain and Application Image Approval*](/v1/docs/users-guide-domain-and-application-image-approval-1)*.*
6. After the image is approved, a green tick will appear in the **Approval status** column for that image.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3139) - Copy.png)

**Figure 17: Approved AMD SEV-SNP application image**

### 3.6 Azure Confidential Virtual Machine (CVM) Applications

Before creating the image, ensure that you have collected the required Platform Configuration Register (PCR) values from the Azure CVM environment.

*For more information on deploying a CVM on Azure and obtaining PCR values for creating the application image, refer to the following guides:*

- [*Fortanix CCM Azure Confidential VM Setup – Linux*](/v1/docs/azure-confidential-vm-setup-linux-1)
- [*Fortanix CCM Azure Confidential VM Setup – Windows*](/v1/docs/azure-confidential-vm-setup-windows-1)

Perform the following steps to create an image for the Azure CVM application:

1. After you create an Azure CVM application, click the **Applications** menu item in the CCM UI left navigation panel and select the required Azure CVM application for which you want to configure an application image.
2. On the following page, click **+ ADD IMAGE** to configure the image of the Azure CVM application.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3252) - Copy.png)

**Figure 18: Images tab for the selected Azure CVM application**
3. On the **Image** form:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3253).png)

**Figure 19: Add Image form for the Azure CVM application**
  1. **Image Version**: Enter a version identifier for the image in the format **<image-version>**.
  2. **Platform Configuration Register (PCR)**: Enter one or more PCR values collected from the Azure CVM. These values are verified during attestation to validate the integrity of the workload. You can enter values from PCR0 to PCR22 in 64-character hex string format only, depending on your security requirements.

> [!NOTE]
> NOTE
> 
> - When entering PCR values copied from the VM console, remove the “**0X**” prefix from each value, if any.
> - No two application images in Fortanix CCM can use the same combination of PCR values. However, you can create multiple images if their PCR combinations differ.
> 
> For example,
>   - Image 1: [**pcr0** – `abc`]
> 
> Image 2: [**pcr0** – `def`]
> 
> OR
>   - Image 1: [**pcr0** - `abc`]
>   - Image 2: [**pcr0** - `abc`, **pcr1** - `xyz`]
4. Click **SAVE** to create the image.
5. An image approval task is created and added, which is visible on the **Tasks** page. You can approve the task to approve the image.

*For more information on how to approve the application image tasks for the Azure CVM application, refer to* [*Domain and Application Image Approval*](/v1/docs/users-guide-domain-and-application-image-approval-1)*.*
6. After the image is approved, a green tick will appear in the **Approval status** column for that image.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3252).png)

**Figure 20: Approved Azure CVM application image**

After configuring the application and image in Fortanix CCM and registering the required PCR values, the Azure CVM must run the Fortanix Attestation Client for Windows to establish trust and register itself as an approved compute instance.

*For detailed steps to complete the attestation workflow for an Azure CVM using Fortanix CCM in Windows-based environments, click* [*here*](/v1/docs/azure-confidential-vm-attestation-windows-1).

*For detailed steps to complete the attestation workflow for an Azure CVM using Fortanix CCM in Linux-based environments, click* [*here*](/v1/docs/azure-cvm-attestation-guide-linux-1).

#### 3.6.1 How PCR Values Influence Image Attestation

During Azure CVM attestation, images are validated against their configured PCR values. When multiple images are enrolled, the attestation service evaluates PCRs in priority order to determine which image should be attested. The examples below illustrate how different PCR configurations affect this selection.

- If you do not provide any PCR values for an image, the attestation will still succeed for this image only if there is no matching image determined by the PCR priority.

For example:

In this case, Image 1 will be attested.
  - Image 1 = [**pcr0** – not set]
  - Image 2 = [**pcr1** - `xxx`]
  - Azure CVM = **pcr0** - `aaa`, **pcr1** - `bbb`
- If multiple images are enrolled and at least one image has valid PCR values, the image without PCR values will not be considered.

For example:

In this case, Image 2 will be attested.
  - Image 1 = [**pcr0** – not set, **pcr1** - `bbb`]
  - Image 2 = [**pcr0** - `aaa`, **pcr1** – `bbb`]
  - Azure CVM = **pcr0** - `aaa`, **pcr1** - `bbb`
- The images with valid PCR values will be evaluated for attestation based on their priority order.

For example:

In this case, Image 1 will be attested because **pcr0** and **pcr1** have the highest priority.

The order in which the images were created does not affect the attestation decision.
  - Image 1 = [**pcr0** - `aaa`, **pcr1** - `bbb`]
  - Image 2 = [**pcr3** - `ddd`, **pcr4** - `eee`]
  - Image 3 = [**pcr7** - `hhh`, **pcr9** - `jjj`]
  - Image 4 = [**pcr9** - `jjj`, **pcr10** - `lll`, **pcr11** - `mmm`]
  - The Azure CVM = **pcr0** - `aaa`, **pcr1** - `bbb`, **pcr2** - `ccc`, **pcr3** - `ddd`, **pcr4** - `eee`, **pcr5** - `fff`, pcr6 - `ggg`, **pcr7** - `hhh`, **pcr8** - `iii`, **pcr9** - `jjj`, **pcr10** - `lll`, **pcr11** - `mmm`
- If two images are enrolled - one without PCR values set and another that is not approved in Fortanix CCM, the attestation process will evaluate the available PCR values based on their priority order.

For example:

In this case, Image 2 will be selected for attestation because it has PCR values of highest priority defined. However, the attestation will fail since Image 2 is not an approved build. To resolve this, either approve image 2 or delete it.
  - Image 1 = [**pcr0** – not set, **pcr1** - `bbb`]
  - Image 2 (unapproved) = [**pcr0** - `aaa`, **pcr1** - `bbb`]
  - Azure CVM = **pcr0** - `aaa`, **pcr1** – `bbb`
- If two images are enrolled - one without PCR values set and another whose PCR values do not fully match the Azure CVM, the attestation process will evaluate the available PCR values based on their priority order.

For example:

In this case, Image 2 will be selected for attestation because its highest-priority matching PCR (**pcr0**) aligns with the Azure CVM. However, the attestation will fail because the remaining PCRs do not match the Azure CVM PCR values. To resolve this, either delete Image 2, or create and approve Image 3, which is a copy of Image 1 but with **pcr0** set so that it has a higher priority than Image 2.
  - Image 1 = [**pcr0** – not set, **pcr1** - `bbb`]
  - Image 2 = [**pcr0** - `aaa`, **pcr2** - `ccc`]
  - Azure CVM = **pcr0** - `aaa`, **pcr1** – `bbb`
  - Image 3 = [**pcr0** - `aaa`, **pcr1** - `bbb`]
- If all PCR values are invalid for an image (for example, set to all zeros), the attestation certificate is not generated. To determine the reason for the failure, you must check the agent logs. When run with `RUST_LOG=debug`, the log will display the message `‘Build with matching PCRs not found’`.

A security object is any datum stored in DSM (for example a key, a certificate, a password, or other security objects). Each security object is assigned to exactly one group. users and applications assigned to the group have permission to see the security object and to perform operations on it.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Application Build Registry](/fortanix-ccm-application-build-registry.md)
- [Deploying the ACI Application Using Azure Portal](/fortanix-ccm-deploying-the-aci-application-using-azure-portal.md)
- [Supported VMs for Azure Confidential Computing](/fortanix-ccm-supported-vms-for-azure-confidential-computing.md)
- [Running an Example Application using AWS Nitro Platform](/fortanix-ccm-running-an-example-application-using-aws-nitro-platform.md)