Azure THIM has expired - when will cache be updated?

Question

Azure THIM has expired - when will cache be updated?

Matt Curtis 0

We are currently unable to start our services because they cannot verify attestations while the Azure PCCS is serving expired TCB data. Intel sent out an email to say anyone using old TCB data is going to start failing attestations and we're seeing those errors now, the data being served by the Azure cache is from 2023 (https://global.acccache.azure.net/sgx/certification/v4/tcb?fmspc=00606a000000&clientid=production_client)

What's the ETA for serving latest TCB data on the PCCS service? This is causing major issues for us.

We see OE_VERIFY_FAILED errors like ERROR: mbedtls_x509_crt_verify failed with The certificate validity has expired when validating the attestations.

Alex Burlachenko 10,565 Reputation points

2025-05-23T08:42:13.9833333+00:00
Hey Matt,

Thanks a lot for posting your question on the Q&A portal and sharing those details about the issue you're facing. It sounds really frustrating, especially when it's blocking your services from starting properly. Let me try to help clarify what's going on and what you can expect.

First off, the expired tcb data in the azure pccs cache is definitely the root cause here. Intel did recently notify everyone that using old tcb data would start causing attestation failures, and that's exactly what you're seeing with those oe_verify_failed errors. The cache is still serving data from 2023, which is why your services can't verify attestations anymore.

Microsoft is aware of this issue and is working on updating the cache with the latest tcb data. Unfortunately, I don't have an exact eta for when the update will be fully rolled out, but the team is prioritizing it since it's affecting multiple customers.

In the meantime, one workaround you could try is configuring your services to use Intel's pccs directly instead of relying on the azure cache. This might help bypass the expired data issue temporarily.

Also, those mbedtls_x509_crt_verify errors are happening because the certificates in the tcb data are indeed expired. It's not a problem on your end, so don't worry too much about that part. Once the cache is updated, those errors should go away.

I know this isn't the most satisfying answer since there's no fixed timeline yet, but hopefully the workaround helps for now. The azure team is usually pretty quick with these updates, so it shouldn't be too long. If you need more immediate assistance, you might want to open a support ticket so they can prioritize your case specifically.

Let me know if you run into any other issues or if there's anything else I can help with. Fingers crossed this gets resolved soon for you ))

Best regards, Alex P.S. If my answer help to you, please Accept my answer PPS That is my Answer and not a Comment https://ctrlaltdel.blog/
Siva Pavuluri 570 Reputation points Microsoft External Staff Moderator

2025-05-23T10:45:56.9266667+00:00
Hi Matt Curtis,

I understand your concern regarding failures caused by expired TCB (Trusted Computing Base) data being served by Azure's PCCS (Provisioning Certification Caching Service).

Trusted Hardware Identity Management is essential for Azure Confidential Computing (ACC), as it caches Trusted Execution Environment (TEE) collateral from providers like Intel and AMD. This cached data is crucial for attestation services and ACC nodes, ensuring TEEs remain verifiable and their security claims up-to-date.

Within this framework, PCCS specifically manages Intel SGX attestation by caching certificates from Intel's provisioning service to validate enclave trustworthiness. While both systems rely on pre-cached cryptographic data to streamline attestation, Trusted Hardware Identity Management encompasses a broader range of TEE technologies beyond just SGX.. trusted-hardware-identity-management

Please check the below points:

Check Certificate Expiry – Verify the expiration date of the certificate used for attestation.

Refresh Cached Collateral – If using Azure Confidential Computing, ensure that the cached TEE collateral is up to date.

Update PCCS Cache – If relying on Intel SGX attestation, manually refresh the PCCS cache to pull the latest certificates.

Verify System Time – Ensure that the system clock is correctly synchronized, as incorrect time settings can cause expiration errors.

Check for Provider Updates – Sometimes, Intel or other TEE providers release updated certificates that need to be manually retrieved.

I hope these helps. Let me know if you have any further questions or need additional assistance.

Thank you
Siva Pavuluri 570 Reputation points Microsoft External Staff Moderator

2025-05-26T03:15:16.0633333+00:00

Hi Matt Curtis,

I just wanted to check if you got a chance to review my information and please let me know if you have any further queries. If the information is helpful, please "Upvote it."

Thank you
Siva Pavuluri 570 Reputation points Microsoft External Staff Moderator

2025-05-27T01:05:45.58+00:00

Hi Matt Curtis,

I just wanted to check if you got a chance to review my information and please let me know if you have any further queries. If the information is helpful, please "Upvote it."

Thank you

Your answer

Siva Pavuluri 570 Reputation points Microsoft External Staff Moderator

2025-05-23T10:45:56.9266667+00:00

Hi Matt Curtis,

I understand your concern regarding failures caused by expired TCB (Trusted Computing Base) data being served by Azure's PCCS (Provisioning Certification Caching Service).

Trusted Hardware Identity Management is essential for Azure Confidential Computing (ACC), as it caches Trusted Execution Environment (TEE) collateral from providers like Intel and AMD. This cached data is crucial for attestation services and ACC nodes, ensuring TEEs remain verifiable and their security claims up-to-date.

Within this framework, PCCS specifically manages Intel SGX attestation by caching certificates from Intel's provisioning service to validate enclave trustworthiness. While both systems rely on pre-cached cryptographic data to streamline attestation, Trusted Hardware Identity Management encompasses a broader range of TEE technologies beyond just SGX.. trusted-hardware-identity-management

Please check the below points:

Check Certificate Expiry – Verify the expiration date of the certificate used for attestation.

Refresh Cached Collateral – If using Azure Confidential Computing, ensure that the cached TEE collateral is up to date.

Update PCCS Cache – If relying on Intel SGX attestation, manually refresh the PCCS cache to pull the latest certificates.

Verify System Time – Ensure that the system clock is correctly synchronized, as incorrect time settings can cause expiration errors.

Check for Provider Updates – Sometimes, Intel or other TEE providers release updated certificates that need to be manually retrieved.

I hope these helps. Let me know if you have any further questions or need additional assistance.

Thank you
Siva Pavuluri 570 Reputation points Microsoft External Staff Moderator

2025-05-26T03:15:16.0633333+00:00

Hi Matt Curtis,

I just wanted to check if you got a chance to review my information and please let me know if you have any further queries. If the information is helpful, please "Upvote it."

Thank you
Siva Pavuluri 570 Reputation points Microsoft External Staff Moderator

2025-05-27T01:05:45.58+00:00

Hi Matt Curtis,

I just wanted to check if you got a chance to review my information and please let me know if you have any further queries. If the information is helpful, please "Upvote it."

Thank you

Share via

Azure THIM has expired - when will cache be updated?

Your answer