CCA-CERT-01: CCA token is signed by a trusted Arm CCA platform

Property	Value
Severity	critical
Platform	Arm CCA fleets
Lifecycle stage	hardware
Policy	P-04: Attestation evidence is fresh and fully verified
Evaluated from	Evidence sent to the service (collector bundles or registry scans), not from a cloud API scan.

What it checks

It passes when:

• Platform token signed by a CPAK this fleet trusts; it binds the realm attestation key that signed the realm token.

How to fix

• Treat this realm as untrusted, or add the platform's CPAK (from the silicon vendor's endorsement) to the fleet if it is yours.

After the fix, scan again: the check should report PASS.

Related

• Other checks for policy P-04: CSPACE-ATT-01, CSPACE-ATT-02, CSPACE-ATT-03, GPU-CERT-01, GPUCC-ATT-01, NITRO-ATT-02, NITRO-ATT-03, SE-CERT-01, SGX-CERT-01, SNP-CERT-01, TDX-CERT-01

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).