This article describes the procedure for configuring a Fortanix Confidential Computing Manager (CCM) deployment to work with an Azure Confidential Virtual Machine (CVM) in Linux-based environment.
The setup includes creating a Linux CVM in the Azure portal and preparing the attestation configuration required to register and validate the workload in Fortanix CCM.
2.0 Prerequisites
Before you begin, ensure the following requirements are met:
You have access to an active Azure subscription and permissions to create and manage Confidential Virtual Machines in the Azure portal.
You have determined which PCR indexes (such as PCR0, PCR1, PCR7, and so on) your attestation policy should validate.
2.1 Azure CVM Requirements
Azure Confidential VMs provide hardware-based memory encryption and attestation. Your VM image must be compatible with Azure’s confidential computing requirements while also enforcing strong OS-level security.
Hardware Requirements:
VM SKU: You must use an Azure Confidential Computing VM family that supports AMD SEV-SNP technology and includes an “a” in the VM size. Supported families include DCasv5, ECasv5 series, or NCCasv5.
Generation: Generation 2 VM images are mandatory.
Boot Architecture: The Azure CVMs must use Unified Extensible Firmware Interface (UEFI) boot. Legacy Basic Input/Output System (BIOS) boot is not supported.
Security Features: The following features are hardware-enforced and must be validated for the Azure CVM:
Secure Boot is enabled.
Virtual Trusted Platform Module (vTPM) is enabled.
Refer to the following Microsoft Azure documentation for instructions on enabling these features:
In the left navigation panel, select Virtual machines and click + Create.
From the Create drop down menu, select the Virtual machine option.
On the Basics tab, configure the required details:
Subscription: Select the required Azure subscription.
Resource group: Select an existing resource group or create a new one. For example, demo-vm_group.
Instance details:
Virtual machine name: Enter a unique name for your CVM instance in Azure.
Region: Select a region that supports Confidential Computing workloads. Azure CVM options appear only in supported regions.
Availability options: Select the availability configuration based on redundancy requirements. For example, no redundancy or availability zones.
Zone options: Select Self-selected zone.
Availability zone: Select the appropriate zone.
Security type: Select Confidential virtual machines to enable a hardware-based trusted execution environment.
Image: Select Ubuntu Server 24.04 LTS (Confidential VM) – x64 Gen2 to support Azure CVM deployment for Linux OS.
VM architecture: Select x64 processor architecture .
Run with Azure Spot discount (Optional): Enables reduced cost and non-production deployments. This is not recommended for workloads requiring guaranteed uptime.
Size: Select the VM size as Standard_DC4as_v5 – 4 vCPUs, 16 GiB memory for Linux OS.
Authentication account:
Authentication type: Select SSH public key or Password-based authentication to access the VM.
Username: Enter the administrator username used to access the VM.
SSH public key source: Select Generate new key pair to create and store a new SSH key pair.
SSH Key Type: Select the RSA SSH Format option for secure access.
Key pair name: Enter a name for the generated SSH key pair.
Inbound port rules:
Public inbound ports: Select Allow selected ports to allow controlled public network access.
Select inbound ports: Select SSH (22) to allow remote access to the VM.
NOTE
This will allow all IP addresses to access your virtual machine.
Click Review + create at the bottom of the screen.
Figure 1: Create VM for Linux
Once validation completes successfully, click Create to create the Azure CVM.
After creating the VM, connect to it using SSH to generate the PCR values required for attestation.
4.0 Install Dependencies
The attestation client requires Trusted Platform Module (TPM) communication libraries and OpenSSL to read platform measurements and submit attestation evidence.
Run the following command to refresh the package lists:
sudo apt update && sudo apt upgrade
Run the following command to install all required dependencies on the VM created in the previous section:
sudo apt-get install -y tpm2-tools
4.1 Dependency Details
The following table lists the required system libraries and services needed for TPM access and secure attestation execution:
File
Purpose
Ubuntu 24.04 Package
libtss2-esys.so.0
TPM communication library
libtss2-esys 3.0.2-0t64
libtss2-tctildr.so.0
TPM communication library
libtss2-tctildr0t64
libtss2-mu.so.0
TPM communication library
libtss2-mu-4.0.1-0
tpm-udev.service
Set up TPM device permissions
tpm-udev
libssl.so.3
OpenSSL cryptography library
libssl3t64
5.0 Determine PCR Values
After the Azure CVM is successfully deployed, retrieve the PCR values for the required indexes for attestation. Any single PCR value or a combination of multiple PCR values can be used when defining the image policy, depending on the security requirements.
Use one of the following methods to generate the PCR values for Linux OS:
Option 1: Generate PCR values using one of the following tools:
systemd-measure
systemd-pcrlock
Option 2: Run the following command to collect PCR values directly from the deployed Azure CVM:
sudo tpm2_pcrread sha256
Copy the required PCR values and use them during image configuration in Fortanix CCM.
NOTE
The following figure illustrates sample PCR values and must not be used in your configuration.
Figure 2: Sample PCR values
Once the PCR values are available, create the image for the CVM application. For more information on creating an image for the Azure CVM application, refer to Create an Image.
