keylime.conf

#=============================================================================
[general]
#=============================================================================

# Turn on or off TLS Keylime wide.
enable_tls = True

# The address and port of the revocation notifier service on the verifier from
# which either the cloud_agent or keylime_ca receive revocation events.
receive_revocation_ip = 127.0.0.1
receive_revocation_port = 8992

#=============================================================================
[cloud_agent]
#=============================================================================
# The Python agent is deprecated and will be removed with the next major release (7.0.0)!
# Please migrate to the Rust based agent: https://github.com/keylime/rust-keylime/


# The binding address and port for the agent server
cloudagent_ip = 127.0.0.1
cloudagent_port = 9002

# Address and port where the verifier and tenant can connect to reach the agent.
# These keys are optional.
agent_contact_ip = 127.0.0.1
agent_contact_port = 9002

# The address and port of registrar server which agent communicate with
registrar_ip = 127.0.0.1
registrar_port = 8890

# The name of the RSA key that Keylime should use for protecting shares of U/V.
# If rsa_keyname is not a absolute path it is relative to /var/lib/keylime/secure.
rsa_keyname = tci_rsa_key

# Enable mTLS communication between agent, verifier and tenant.
# Details on why setting it to "False" is generally considered insecure can be found
# on https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
mtls_cert_enabled = True

# The name of the X509 certificate that is used for mTLS. Uses the rsa_keyname as a key.
# If mtls_cert is not a absolute path it is relative to /var/lib/keylime/secure.
# This certificate must be self signed.
mtls_cert = tci_mtls_cert

# The CA that signs the client certificates of the tenant and verifier.
# If set to default it tries to use /var/lib/keylime/cv_ca/cacert.crt
keylime_ca = default

# The name that should be used for the encryption key, placed in the
# /var/lib/keylime/secure/ directory.
enc_keyname = derived_tci_key

# The name that should be used for the optional decrypted payload, placed in
# the /var/lib/keylime/secure directory.
dec_payload_file = decrypted_payload

# The size of the memory-backed tmpfs partition where Keylime stores crypto keys.
# Use syntax that the 'mount' command would accept as a size parameter for tmpfs.
# The default below sets it to 1 megabyte.
secure_size = 1m

# Use this option to set the TPM ownerpassword to something you want to use.
# Set it to "generate" if you want Keylime to choose a random owner password
# for you.
tpm_ownerpassword = keylime

# Whether to allow the cloud_agent to automatically extract a zip file in
# the delivered payload after it has been decrypted, or not. Defaults to "true".
# After decryption, the archive will be unzipped to a directory in /var/lib/keylime/secure.
# Note: the limits on the size of the tmpfs partition set above with the 'secure_size'
# option will affect this.
extract_payload_zip = True

# The agent's UUID.
# If you set this to "generate", Keylime will create a random UUID.
# If you set this to "hash_ek", Keylime will set the UUID to the result
# of 'SHA256(public EK in PEM format)'.
# If you set this to "environment", Keylime will use the value of the
# environment variable "KEYLIME_AGENT_UUID" as UUID.
# If you set this to "dmidecode", Keylime will use the UUID from
# 'dmidecode -s system-uuid'.
# If you set this to "hostname", Keylime will use the full qualified domain
# name of current host as the agent id.
agent_uuid = d432fbb3-d2f1-4a97-9ef7-75bd81c00000

# Whether to listen for revocation notifications from the verifier or not.
listen_notifications = True

# The path to the certificate to verify revocation messages received from the
# verifier.  The path is relative to /var/lib/keylime.
# If set to "default", Keylime will use the file RevocationNotifier-cert.crt
# from the unzipped contents provided by the tenant.
revocation_cert = default

# A comma-separated list of Python scripts to run upon receiving a revocation
# message. Keylime will verify the signature first, then call these Python
# scripts with the json revocation message.  The scripts must be located in
# the 'revocation_actions' directory.
#
# Keylime will also get the list of revocation actions from the file
# action_list in the unzipped contents provided by the verifier.
# All actions must be named local_action_[some name].
revocation_actions=

# A script to execute after unzipping the tenant payload.  This is like
# cloud-init lite =)  Keylime will run it with a /bin/sh environment and
# with a working directory of /var/lib/keylime/secure/unzipped.
payload_script=autorun.sh

# In case mTLS for the agent is disabled and the use of payloads is still
# required, this option has to be set to "True" in order to allow the agent
# to start. Details on why this configuration (mTLS disabled and payload enabled)
# is generally considered insecure can be found on
# https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
enable_insecure_payload = False

# Jason @henn made be do it! He wanted a way for Keylime to measure the
# delivered payload into a pcr of choice.
# Specify a PCR number to turn it on.
# Set to -1 or any negative or out of range PCR value to turn off.
measure_payload_pcr=-1

# Wether or not to use an exponantial backoff algorithm for retries.
exponential_backoff = True

# Either how long to wait between failed attempts to communicate with the TPM
# in seconds, or the base for the exponential backoff algorithm.
# Floating point values accepted here.
retry_interval = 2

# Integer number of retries to communicate with the TPM before giving up.
max_retries = 4

# TPM2-specific options, allows customizing default algorithms to use.
# Specify the default crypto algorithms to use with a TPM2 for this agent.
# On kernel versions less than 5.10 choose sha1 as hash algorithm, because
# otherwise IMA attestation will fail.
#
# Currently accepted values include:
# - hashing:    sha512, sha384, sha256 or sha1
# - encryption: ecc or rsa
# - signing:    rsassa, rsapss, ecdsa, ecdaa or ecschnorr
tpm_hash_alg = sha1
tpm_encryption_alg = rsa
tpm_signing_alg = rsassa

# If an EK is already present on the TPM (e.g., with "tpm2_createek") and
# you require Keylime to use this EK, change "generate" to the actual EK
# handle (e.g. "0x81000000"). The Keylime agent will then not attempt to
# create a new EK upon startup, and neither will it flush the EK upon exit.
ek_handle = generate

# The user account to switch to to drop privileges when started as root
# If left empty, the agent will keep running with high privileges.
# The user and group specified here must allow the user to access the
# WORK_DIR (typically /var/lib/keylime) and /dev/tpmrm0. Therefore,
# suggested value for the run_as parameter is keylime:tss.
# The following commands should be used to set ownership before running the
# agent:
# chown keylime /var/lib/keylime
#
# If tpmdata.yml already exists:
# chown keylime /var/lib/keylime/tpmdata.yml
#
# If cv_ca directory exists:
# chown keylime /var/lib/keylime/cv_ca
# chown keylime /var/lib/keylime/cv_ca/cacert.crt
#
run_as =

#=============================================================================
[cloud_verifier]
#=============================================================================

# Unique identifier for the each verifier instances.
cloudverifier_id = default

# The IP address and port of verifier server binds to
cloudverifier_ip = 127.0.0.1
cloudverifier_port = 8881

# The address and port of registrar server that verifier communicates with
registrar_ip = 127.0.0.1
registrar_port = 8891

# Cloud Verifier (CV) TLS options.  This is for authenticating the CV itself,
# authenticating the users of the CV and securing the transmission of keys.
# The 'tls_dir' option will place Certificate Authority (CA) certificates and
# files for TLS in the /var/lib/keylime/ directory.
#
# Set to "generate" to automatically generate a CA/certificates in the 'cv_ca'
# directory.
# Note: if set to "generate", the 'ca_cert', 'my_cert', and 'private_key'
# options must all be set to "default".
# If you specify "generate", you can manage the CA that the verifier will create
# using keylime_ca -d /var/lib/keylime/cv_ca/.
tls_dir = generate

# The filename of the CA cert for verifying client certificates, placed in the
# 'tls_dir' directory.
ca_cert = default

# The filename of the cloud verifier certificate and private key, placed in the
# 'tls_dir' directory.
# The following two options also take the value "default" to find files
# with names such as <fully_qualified_domain_name>-cert.crt and
# <fully_qualified_domain_name>-private.pem for the cert and private key,
# respectively.
my_cert = default
private_key = default

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# If 'tls_dir = generate', this password will also be used to protect the
# generated CA private key.
private_key_pw = default

# Whether verifier validates client certificate
check_client_cert = True

# mTLS configuration for connecting to the agent.
# Details on why setting it to "False" is generally considered insecure can be found
# on https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
agent_mtls_cert_enabled = True
# Set 'agent_mtls_cert' to 'CV' for using the CV CA for the connections.
agent_mtls_cert = CV
agent_mtls_private_key =
agent_mtls_private_key_pw =

# Database URL Configuration
# See this document https://keylime.readthedocs.io/en/latest/installation.html#database-support
# for instructions on using different database configurations.
# There are two options for the specification of the database connection configuration.
# 1) A tuple of parameters (e.g., database_drivername, database_username, database_password)
# 2) A single string in database_url. This, when set, takes precedence over the previous option.
# An example of database_url value for using sqlite:
#   sqlite:////var/lib/keylime/cv_data.sqlite
# An example of database_url value for using mysql:
#   mysql+pymysql://keylime:keylime@keylime_db:[port]/verifier?charset=utf8
# If database_url is not set, the default is "sqlite", using method 1, and will be
# located at "/var/lib/keylime/cv_data.sqlite".
database_url =
database_drivername = sqlite
database_username = ''
database_password = ''
database_host = ''
database_name = cv_data.sqlite
# Limits for DB connection pool size in sqlalchemy (https://docs.sqlalchemy.org/en/14/core/pooling.html#api-documentation-available-pool-implementations)
database_pool_sz_ovfl=5,10

auto_migrate_db = True

# The number of worker processes to use for the cloud verifier.
# Set to "0" to create one worker per processor.
multiprocessing_pool_num_workers = 0

# Wether or not to use an exponantial backoff algorithm for retries.
exponential_backoff = True

# Either how long to wait between failed attempts to connect to a cloud agent
# in seconds, or the base for the exponential backoff algorithm.
# Floating point values accepted here.
retry_interval = 2

# Number of retries to connect to an agent before giving up. Must be an integer.
max_retries = 5

# Time between integrity measurement checks, in seconds.  If set to "0", checks
# will done as fast as possible.  Floating point values accepted here.
quote_interval = 2

# Enable listed revocation notification methods.
#
# Available methods are:
#
# "agent": Deliver notification directly to the agent via the REST
# protocol.
#
# "zeromq": Enable the ZeroMQ based revocation notification method;
# revocation_notifier_ip and revocation_notifier_port options must be
# set. Currently this only works if you are using keylime-CA.
#
# "webhook": Send notification via webhook. The endpoint URL must be
# configured with webhook_url option. This can be used to notify other
# systems that do not have a Keylime agent running.
revocation_notifiers = agent

# The binding address and port of the revocation notifier service.
# If the 'revocation_notifier' option is set to "true", then the verifier
# automatically starts the revocation service.
revocation_notifier_ip = 127.0.0.1
revocation_notifier_port = 8992

# Webhook url for revocation notifications.
webhook_url = ''

# The verifier limits the size of upload payloads (allowlists) which defaults to
# 100MB (104857600 bytes). This setting can be raised (or lowered) based on the
# size of the actual payloads
max_upload_size = 104857600

# The name of the boot attestation policy to use in comparing a measured boot event log
# with a measured boot reference state.
# A policy is a Python object that `isinstance` of `keylime.mba.elchecking.policies.Policy`
# and was registered by calling `keylime.mba.elchecking.policies.register`.
# The keylime agent extracts the measured boot event log.
# The verifier client specifies the measured boot reference state to use;
# this is specified independently for each agent.
# Depending on the policy, the same reference state may be usable with multiple agents.
# The `accept-all` policy ignores the reference state and approves every log.
measured_boot_policy_name = accept-all

# This is a comma-separated list of Python modules to dynamically load,
# for example to register additional boot attestation policies.
# Empty strings in the list are ignored
# (e.g., a value of `a,b,` means the same thing as `a,b`).
# A module here may be relative, in which case it is interpreted
# relative to the keylime.mba.elchecking package.
# The default value for this config item is the empty string.
# measured_boot_imports = keylime.mba.elchecking

# Severity labels for revocation events strictly ordered from least severity to
# highest severtiy.
severity_labels = ["info", "notice", "warning", "error", "critical", "alert", "emergency"]

# Severity policy that matches different event_ids to the severity label.
# The rules are evaluated from the beginning of the list and the first match is
# used. The event_id can also be a regex. Default policy assigns the highest
# severity to all events.
severity_policy = [{"event_id": ".*", "severity_label": "emergency"}]

# If files are already opened when IMA tries to measure them this causes
# a time of measure, time of use (ToMToU) error entry.
# By default we ignore those entries and only print a warning.
# Set to True to treat ToMToU entries as errors.
tomtou_errors = False

# Durable Attestation is currently marked as an experimental feature
# In order to enable Durable Attestation, an "adapter" for a Persistent data Store 
# (time-series like database) needs to be specified. Some example adapters can be 
# found under "da/examples" so, for instance 
#      "durable_attestation_import = keylime.da.examples.redis.py"
# could be used to interact with a Redis (Persistent data Store)
durable_attestation_import =

# If an adapter for Durable Attestation was specified, then the URL for a Persistent Store
# needs to be specified here. A second optional URL could be specified, for a 
# Rekor Transparency Log. A third additional URL could be specified, pointing to a 
# Time Stamp Authority (TSA), compatible with RFC3161. Additionally, one might need to 
# specify a path containing certificates required by the stores or TSA. Continuing with 
# the above example, the following values could be assigned to the parameters: 
#      "persistent_store_url = redis://127.0.0.1:6379?db=10&password=/root/redis.auth&prefix=myda"
#      "transparency_log_url = http://127.0.0.1:3000"
#      "time_stamp_authority_url = http://127.0.0.1:2020"
#      "time_stamp_authority_certs_path = ~/mycerts/tsa_cert1.pem"
persistent_store_url =
transparency_log_url =
time_stamp_authority_url =
time_stamp_authority_certs_path =

# If Durable Attestation was enabled, which requires a Persistent Store URL 
# to be specified, the two following parameters control the format and enconding
# of the stored attestation artifacts (defaults "json" for format and "" for encoding)
persistent_store_format = json
persistent_store_encoding = 

# If Durable Attestation was enabled with a Transparency Log URL was specified,
# the digest algorithm for signatures is controlled by this parameter (default "sha256")
transparency_log_sign_algo = sha256

# If Durable Attestation was enabled with a Transparency Log URL was specified,
# a keylime administrator can specify some agent attributes (including attestation
# artifacts, such as quotes and logs) to be signed by the verifier. The use of "all"
# will result in the whole "package" (agent + artifacts) being signed and leaving it empty
# will mean no signing should be done.
signed_attributes =

# If enabled, the Keylime verifier will require that a file signature and
# associated key be sent alongside newly-created allowlists, and will perform a
# signature check before storing them in the database.
require_allow_list_signatures = False


#=============================================================================
[tenant]
#=============================================================================

# The default Verifier server address and port if not specified in the command
cloudverifier_ip = 127.0.0.1
cloudverifier_port = 8881

# The default Registrar server address and port if not specified in the command
registrar_ip = 127.0.0.1
registrar_port = 8891

# Tenant client TLS options.

# This is for authenticating the CV itself and proving that the tenant is
# allowed talk to the CV.
# The 'tls_dir' option will look for client certificates for talking to the CV
# in the /var/lib/keylime/ directory.
# Set to "default" to use the CA setup by the cloud_verifier on the same machine.
# Fles will be in the /var/lib/keylime/cv_ca/ directory.
tls_dir = default

# The following three options set the filenames where the CA certificate,
# client certificate, and client private key file are, relative to the 'tls_dir'.
# If 'tls_dir = default', then default values will be used for 'ca_cert = cacert.crt',
# 'my_cert = client-cert.crt', and 'private_key = client-private.pem'.
ca_cert = default
my_cert = default
private_key = default

# mTLS configuration for connecting to the agent.
# Details on why setting it to "False" is generally considered insecure can be found
# on https://github.com/keylime/keylime/security/advisories/GHSA-2m39-75g9-ff5r
agent_mtls_cert_enabled = True
# Set 'agent_mtls_cert' to 'CV' for using the CV CA for the connections.
agent_mtls_cert = CV
agent_mtls_private_key =
agent_mtls_private_key_pw =

# EK CA certificate storage location (directory).
# The EK certificate provided by the agent will be validated against the CAs located in that directory.
tpm_cert_store = /var/lib/keylime/tpm_cert_store/

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# if you are using the auto generated keys from the CV, set the same password
# here as you did for 'private_key_pw' in the [cloud_verifier] section.
private_key_pw = default

# Registrar client TLS options. This allows the tenant to authenticate the
# registar before asking for AIKs.
# this option sets the directory where the CA certificate for the registrar
# can be found
# use "default" to use 'reg_ca' (this points it to the directory automatically
# created by the registrar if it is set to "generate"
# use "CV" to use 'cv_ca', the directory automatically created (and shared
# with the registar) by the CV
registrar_tls_dir = CV

# The following three options set the filenames where the registrar CA certificate,
# client certificate, and client private key file are, relative to the 'tls_dir'.
# if 'tls_dir = default', then default values will be used for 'ca_cert = cacert.crt',
# 'my_cert = client-cert.crt', and 'private_key = client-private.pem'.
registrar_ca_cert = default
registrar_my_cert = default
registrar_private_key = default

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# if you are using the auto generated keys from the CV, set the same password
# here as you did for 'private_key_pw' in the [cloud_verifier] section.
registrar_private_key_pw = default

# Max size of a payload the tenant will take, in bytes (default 1 megabyte).
# Make sure this matches with the value of the 'secure_size' option in the
# [cloud_agent] section.
# Don't send things bigger than the tmpfs where they will be decrypted.
max_payload_size = 1048576

# TPM policies are json structures that takes a list of accepted
# Platform Configuration Registers (PCR) values and will match any in the list
# for that PCR.  These can be a mixture of any hashing algorithms, potentially
# of varying digest lengths (the default policy below supports SHA1, SHA-256
# and SHA-512).
# Note that you can't set a policy on PCR10 and PCR16 because Keylime uses
# them internally.
tpm_policy = {"22":["0000000000000000000000000000000000000001","0000000000000000000000000000000000000000000000000000000000000001","000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001","ffffffffffffffffffffffffffffffffffffffff","ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"],"15":["0000000000000000000000000000000000000000","0000000000000000000000000000000000000000000000000000000000000000","000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]}

# Specify the acceptable crypto algorithms to use with the TPM for this agent.
# Only algorithms specified below will be allowed for usage by an agent.  If an
# agent uses an algorithm not specified here, it will fail validation.
#
# Currently accepted values include:
# hashing:    sha512, sha384, sha256 and sha1
# encryption: ecc and rsa
# signing:    rsassa, rsapss, ecdsa, ecdaa and ecschnorr
accept_tpm_hash_algs = sha512,sha384,sha256,sha1
accept_tpm_encryption_algs = ecc,rsa
accept_tpm_signing_algs = ecschnorr,rsassa

# Wether or not to use an exponantial backoff algorithm for retries.
exponential_backoff = True

# Either how long to wait between failed attempts to connect to a cloud agent
# in seconds, or the base for the exponential backoff algorithm.
# Floating point values accepted here.
retry_interval = 2

# Number of retries to connect to a agent before giving up. Must be an integer.
max_retries = 5

# Tell the tenant whether to require an EK certificate from the TPM.
# If set to False the tenant will ignore EK certificates entirely.
#
# WARNING: SETTING THIS OPTION TO FALSE IS VERY DANGEROUS!!!
#
# If you disable this check, then you may not be talking to a real TPM.
# All the security guarantees of Keylime rely upon the security of the EK
# and the assumption that you are talking to a spec-compliant and honest TPM.

# Some physical TPMs do not have EK certificates, so you may need to set
# this to "False" for some deployments.  If you do set it to "False", you
# MUST use the 'ek_check_script' option below to specify a script that will
# check the provided EK against a allowlist for the environment that has
# been collected in a trustworthy way.  For example, the cloud provider
# might provide a signed list of EK public key hashes.  Then you could write
# an ek_check_script that checks the signature of the allowlist and then
# compares the hash of the given EK with the allowlist.
require_ek_cert = True

# Optional script to execute to check the EK and/or EK certificate against a
# allowlist or any other additional EK processing you want to do. Runs in
# /var/lib/keylime. You call also specify an absolute path to the script.
# Script should return 0 if the EK or EK certificate are valid.  Any other
# return value will invalidate the tenant quote check and prevent
# bootstrapping a key.
#
# The various keys are passed to the script via environment variables:
# EK - contains a PEM encoded version of the public EK
# EK_CERT - contains a DER encoded EK certificate if one is available.
# PROVKEYS - contains a json document containing EK, EKcert, and AIK from the
# provider.  EK and AIK are in PEM format.  The EKcert is in base64 encoded
# DER format.
# TPM_CERT_STORE - contains the path to the TPM certificates store, e.g.:
# "/var/lib/keylime/tpm_cert_store".
#
# Set to blank to disable this check.  See warning above if require_ek_cert
# is "False".
ek_check_script=

#=============================================================================
[registrar]
#=============================================================================

# The registrar's IP address and port used to communicate with other services
# as well as the bind address for the registrar server.
registrar_ip = 127.0.0.1
registrar_port = 8890
registrar_tls_port = 8891

# Registrar TLS options.  This is for authenticating the registrar to clients
# who want to query AIKs.
# The 'tls_dir' option wil place CA certificates and files for TLS in the /var/lib/keylime/
# directory.
#
# Set to "generate" to automatically generate a CA/certificates in the 'reg_ca'
# directory.
# Note: if you specify "generate", you can manage the CA that the verifier will create
# using keylime_ca -d /var/lib/keylime/reg_ca/.
#
# Set to "CV" to share the CA with the cloud verifier (which must be run first
# once before starting the registrar so it can generate the keys).
tls_dir = CV

# The filename (in 'tls_dir') for the registrar's CA cert.
ca_cert = default

# The filename (in 'tls_dir') of the registrar certificate and private key.
# The following two options also take the value "default" to find files
# with names such as <fully_qualified_domain_name>-cert.crt and
# <fully_qualified_domain_name>-private.pem for the cert and private key,
# respectively.
my_cert = default
private_key = default

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# If 'tls_dir = generate', this password will also be used to protect the
# generated CA private key.
private_key_pw = default

# Registrar client TLS options. This allows the registrar to authenticate the
# provider registrar before asking for AIKs.
# This option sets the directory where the CA certificate for the provider
# registrar can be found.
# Use "default" to use 'reg_ca' (this points it to the directory automatically
# created by the registrar if it is set to "generate").
# Use "CV" to use 'cv_ca', the directory automatically created (and shared
# with the registar) by the CV.
registrar_tls_dir = CV

# Set the password needed to decrypt the private key file.
# This should be set to a strong password.
# If you are using the auto generated keys from the CV, set the same password
# here as you did for private_key_pw in the [cloud_verifier] section.
registrar_private_key_pw = default

# Whether registrar validates client certificate
check_client_cert = True

# Database URL Configuration
# See this document https://keylime.readthedocs.io/en/latest/installation.html#database-support
# for instructions on using different database configurations.
# There are two options for the specification of the database connection configuration.
# 1) A tuple of parameters (e.g., database_drivername, database_username, database_password)
# 2) A single string in database_url. This, when set, takes precedence over the previous option.
# An example of database_url value for using sqlite:
#   sqlite:////var/lib/keylime/reg_data.sqlite
# An example of database_url value for using mysql:
#   mysql+pymysql://keylime:keylime@keylime_db:[port]/verifier?charset=utf8
# If database_url is not set, the default is "sqlite", using method 1, and will be
# located at "/var/lib/keylime/cv_data.sqlite".
database_url =
database_drivername = sqlite
database_username = ''
database_password = ''
database_host = ''
database_name = reg_data.sqlite
# Limits for DB connection pool size in sqlalchemy (https://docs.sqlalchemy.org/en/14/core/pooling.html#api-documentation-available-pool-implementations)
database_pool_sz_ovfl=5,10

auto_migrate_db = True


# The file to use for SQLite persistence of provider hypervisor data.
prov_db_filename = provider_reg_data.sqlite

# Durable Attestation is currently marked as an experimental feature
# In order to enable Durable Attestation, an "adapter" for a Persistent data Store 
# (time-series like database) needs to be specified. Some example adapters can be 
# found under "da/examples" so, for instance 
#      "durable_attestation_import = keylime.da.examples.redis.py"
# could be used to interact with a Redis (Persistent data Store)
durable_attestation_import =

# If an adapter for Durable Attestation was specified, then the URL for a Persistent Store
# needs to be specified here. A second optional URL could be specified, for a 
# Rekor Transparency Log. A third additional URL could be specified, pointing to a 
# Time Stamp Authority (TSA), compatible with RFC3161. Additionally, one might need to 
# specify a path containing certificates required by the stores or TSA. Continuing with 
# the above example, the following values could be assigned to the parameters: 
#      "persistent_store_url = redis://127.0.0.1:6379?db=10&password=/root/redis.auth&prefix=myda"
#      "transparency_log_url = http://127.0.0.1:3000"
#      "time_stamp_authority_url = http://127.0.0.1:2020"
#      "time_stamp_authority_certs_path = ~/mycerts/tsa_cert1.pem"
persistent_store_url =
transparency_log_url =
time_stamp_authority_url =
time_stamp_authority_certs_path =

# If Durable Attestation was enabled, which requires a Persistent Store URL 
# to be specified, the two following parameters control the format and enconding
# of the stored attestation artifacts (defaults "json" for format and "" for encoding)
persistent_store_format = json
persistent_store_encoding = 

# If Durable Attestation was enabled with a Transparency Log URL was specified,
# the digest algorithm for signatures is controlled by this parameter (default "sha256")
transparency_log_sign_algo = sha256

# If Durable Attestation was enabled with a Transparency Log URL was specified,
# a keylime administrator can specify some agent attributes (including attestation
# artifacts, such as quotes and logs) to be signed by the registrar. The use of "all"
# will result in the whole "package" (agent + artifacts) being signed and leaving it empty
# will mean no signing should be done.
signed_attributes = ek_tpm,aik_tpm,ekcert


#=============================================================================
[ca]
#=============================================================================

# These options set the metadata that the keylime_ca utility will use when
# creating certificates and CAs.
# These options are also used by the verifier and registrar when using the
# 'tls_dir = generate' option.
# The below options are pretty self-explanatory X509 stuff.
cert_country=US
cert_ca_name=Keylime Certificate Authority
cert_state=MA
cert_locality=Lexington
cert_organization=MITLL
cert_org_unit=53
cert_ca_lifetime=3650
cert_lifetime=365
cert_bits=2048

# This setting allows you to specify where your Certification Revocation List
# (CRL) will be hosted.
# Set to the relevant URL.
# Use "default" to use the tenant machine FQDN as the CRL distribution point.
# WARNING: Use "default" with caution as it will use the result of Python's
# 'socket.getfqdn()' as the hostname. This may not be a properly resolvable
# DNS name in which case you need to specify a hostname where you will
# run the revocation listener (see below).
#
# You can then use keylime_ca -c listen -n ca/RevocationNotifier-cert.crt
cert_crl_dist=http://localhost:38080/crl

#=============================================================================
# GLOBAL LOGGING CONFIGURATION
#=============================================================================

# The only thing really to change here is the default log levels for either
# console or Keylime loggers.

[loggers]
keys = root,keylime

[handlers]
keys = consoleHandler

[formatters]
keys = formatter

[formatter_formatter]
format = %(asctime)s.%(msecs)03d - %(name)s - %(levelname)s - %(message)s
datefmt = %Y-%m-%d %H:%M:%S

[logger_root]
level = INFO
handlers = consoleHandler

[handler_consoleHandler]
class = StreamHandler
level = INFO
formatter = formatter
args = (sys.stdout,)

[logger_keylime]
level = INFO
qualname = keylime
handlers =