System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

TCG-compliant trusted platform module

Updated: September 18, 2026

Want to summarize with AI?

Log in

Describes the TCG-compliant trusted platform module, presenting operational guidelines, associated error messages, benefits, and step-by-step instructions for verifying TPM status and certificates.

A TCG-compliant trusted platform module is a hardware security feature that

  • adheres to Trusted Computing Group (TCG) specifications

  • uses strong cryptographic algorithms such as ECC P384 algorithm for secure identification and attestation, and

  • protects device boot integrity and secure communication through hardware-backed security features.

Additional reference information

These hardware-backed security features enable the creation of Initial Device Identifier (IDevID) and Initial Attestation Keys (IAK), supporting compliance with modern security standards such as TLS 1.3. They also provide resilient fallback mechanisms, including AIKIDO-based keys, if ECC is not provisioned in the TPM or TPM hardware is unavailable. Attestation capabilities are enhanced through new PCR 0–8 measurements. TPM support now includes a SHA-384 bank of PCRs for measured boot, further strengthening trust in early boot stages.

IDevID is a factory-installed digital certificate that uniquely and securely identifies a device, typically using its public key and manufacturer-signed credentials. It authenticates devices when they first connect to a network, ensuring that only genuine, trusted hardware is allowed access. This mechanism is commonly applied in secure onboarding, supply chain security, and zero-touch provisioning scenarios.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

TCG-compliant Trusted Platform Module

Release 25.4.1

Introduced in this release on: Modular Systems (8800 [LC ASIC: Q100, Q200, P100])*

Device security and cryptographic identity are enhanced through new support for a TCG-compliant Trusted Platform Module (TPM) with ECC P-384 key pairs. This feature enables TLS 1.3–based secure communication for critical onboarding workflows such as BootZ and sZTP. Enrolment and attestation are strengthened through TPM PCR 0–8 measurements, establishing a hardware-rooted chain of trust from early boot stage.

CLI:

*This feature is only supported on Cisco 8800-RP2-S hardware variants.

Starting Cisco IOS XR Software Release these features are migrated to TPM:

  • gRPC Extensible Manageability Services Daemon (EMSD)

  • Attestation APP

  • EnrollZ/AttestZ

Guidelines for TCG-compliant Trusted Platform Module

Follow these guidelines to ensure secure and reliable use of TCG-compliant Trusted Platform Module feature:

  • The TCG-compliant Trusted Platform Module (TPM) feature is only supported on Cisco 8000 Series RP2-S variants.

  • TPM enablement occurs automatically on supported Cisco 8000 Series RP2-S hardware variants; there are no manual steps required to activate core TPM functionality.

  • This feature remains permanently enabled and cannot be disabled on future RP2-S hardware that supports TPM.

  • The system gracefully falls back to the AIKIDO module if the TCG-compliant IDevID is not present on Generic TPM, maintaining the operation of critical features such as AttestZ and EnrollZ.

  • BIOS and PCR measurements follow TCG 2.0 specifications to meet industry-standard trusted computing requirements.

  • Applications including EMSD, EnrollZ, and AttestZ are configured to automatically use TPM ECC-based keys and certificates whenever TPM is available.

  • The implementation adheres to Cisco's Security Development Lifecycle (CSDL) standards, encompassing threat modeling, secure coding practices, static analysis, and vulnerability testing.

  • For measurement and PCR extension within TPM, the SHA-384 algorithm is used through the dedicated SHA-384 PCR bank.

TPM usage error messages

Review these error messages during TPM usage.

Table 2. Error Messages during TPM

Error Messages

Reason

No TCG ECC IDevID certificate

The certificate is not provisioned.

No TCG ECC IDevID certificate chain

The certificate chain is missing.

No TCG ECC HW CAPABILITY

The TPM lacks ECC capability.

Benefits of TCG-compliant Trusted Platform Module

TCG-compliant Trusted Platform Module provide several benefits for device identity and attestation.

  • When you migrate from RSA to TCG-compliant ECC P384 algorithm with TPM, you improve protection against cryptographic attacks and tampering. This process significantly strengthens device security.

  • Using TCG-compliant ECC P384 algorithm for device identity helps you create robust and unique cryptographic identification. Detailed PCR measurements improve attestation, ensuring trusted onboarding and secure operations.

  • You can use ECC keys from TPM to adopt TLS 1.3 for security features such as EMSD, and gRPC. TLS 1.3 provides advanced security and faster communications.

  • If the TPM is unavailable, the system uses AIKIDO to maintain operation and ensure service continuity for security-critical functions. However, if TAM supports only RSA-based keys, the device can negotiate only TLS 1.2.

  • Use new show commands to inspect the TPMs state, PCR values, attestation data, and certificate chains. These actions enhance security transparency for your audit and troubleshooting procedures.

Verify TPM status and certificates

Ensure that TPM is active on your device and has the expected cryptographic information for secure operation.

TPM provides hardware-based security and attestation for Cisco routers. Verifying its status, certificates, and integrity measurements is required for compliance and troubleshooting.

Before you begin

Confirm that the router is running a supported Cisco IOS XR release and platform variant.

Procedure

  1. Display TPM security information.

    Example:

    Router# show platform security tpm info all location 0/RP0/CPU0
---------------------------------------------
Node - 0/RP0/CPU0
---------------------------------------------
Device Type            -     TPM
Device PID             -     8800-RP2-S
Device Serial Number   -     FOC2845N1BJ
Device Firmware Version-     0x01.0200
Server Version         -     3
Server Package Version -     13.1.1
Client Package Version -     13.1.1

HA Sudi Root Cert:
---------------------------------------------
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3 (0x3)
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: O=Cisco, CN=Cisco ECC Root CA
        Validity
            Not Before: Apr  4 08:15:44 2013 GMT
            Not After : Sep  7 16:24:07 2099 GMT
        Subject: O=Cisco, CN=Cisco ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
                    04:7e:c0:c3:bc:d8:1b:c6:f3:67:91:4d:d6:78:8c:
                    e6:b5:75:39:04:7f:2f:fe:60:d0:ac:77:2a:d3:6d:
                    02:41:45:54:67:b0:58:b7:19:bf:cc:bd:4b:36:5c:
                    7b:5b:83:38:ec:a6:d7:4d:30:26:61:b3:4b:8b:ab:
                    5e:0e:15:26:3b:4c:88:ab:02:70:c9:22:37:02:50:
                    75:c0:d5:d4:48:34:c7:bf:58:53:fe:ae:cb:8f:73:
                    20:f5:06:5b:12:87:ca
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A4:45:B6:2F:A3:31:B1:76:15:B0:0A:18:33:CA:F6:AD:4F:3D:28:04
    Signature Algorithm: ecdsa-with-SHA384
    Signature Value:
        30:65:02:31:00:f0:9b:71:dc:7b:40:56:9f:ff:61:a9:3a:ba:
        6d:f1:19:10:44:4f:88:f9:80:ff:a5:86:6f:13:89:c8:19:75:
        39:9e:0e:b6:e8:85:bb:9f:06:0d:07:31:11:ba:80:57:2b:02:
        30:08:b9:e0:52:29:8f:89:14:84:28:c7:27:80:1d:98:73:ea:
        97:2c:6b:31:e3:84:b7:ac:48:b1:d6:54:d5:49:35:54:ca:66:
        27:8f:7a:f6:e2:b1:1e:38:ab:8a:a5:f3:86

    The command output is truncated.

  2. View the TPM integrity boot log.

    Example:

    Router# show platform security tpm integrity log boot location 0/rp0/CPU0

+--------------------------------------+
   Node location: node0_RP0_CPU0
+--------------------------------------+
Uptime: 504480
Event Number: 1
Event Type: 03
PCR Index: 0
Event Digest Hash Algorithm: SHA1
Event Digest: AAAAAAAAAAAAAAAAAAAAAAAAAAA=
Event Data: U3BlYyBJRCBFdmVudDAzAAAAAAAAAgACAgAAAAsAIAAMADAAAA==
Event Number: 2
Event Type: 80000008
PCR Index: 0
Event Digest Hash Algorithm: SHA256
Event Digest: 8emdTrXnHLbHk7wXjWIMkF3/rKTUx7aJ7bFbqw5IEv4=
Event Digest Hash Algorithm: SHA384
Event Digest: 6OuqsUTGphX/NRZc82MBOefq1uLmac7i+kCjzmF5emFth2Fvd8NIAY4JruOOQMLM
Event Data: MrVWeEdXauXu7dTksv0FWh/3qy9lCrxrKWRy/2iR+xc=
Event Number: 3
Event Type: 80000008
PCR Index: 0
Event Digest Hash Algorithm: SHA256
Event Digest: mlrPXdkLmp++U11lPwBJZpnJ/qjOpVTxQljh8548Qxs=
Event Digest Hash Algorithm: SHA384
Event Digest: ioW380j8Ujk+EbQCX2Rz3OpJrjkh0ICSOCaJcm6cPdp0m05yma6tAqOk9FXCH145
Event Data: AEtoSI8ICqnAz53G1/XMD4qHH1qkuXmEAhLEUpw5ON4=
Event Number: 4
Event Type: 08

    The command output is truncated.

  3. Check TPM status and take necessary actions.

    Table 3. TPM verification decisions and actions

    If...

    Then...

    TPM is shown as enabled and active

    no further action is required.

    TPM is not present or status is not enabled

    initiate TPM troubleshooting procedures.

    Digest algorithm output is not SHA384 as expected

    verify configuration and consult security policies.

    Integrity log shows unexpected entries

    investigate potential security incidents.

  4. Display Platform Configuration Register (PCR) information.

    Example:

    Router# show platform security tpm pcr 0,1,2,3,4,5,6,7 location 0/rp0/CPU0 nonce 1234
Nonce: 1234

+--------------------------------------+
   Node location: node0_RP0_CPU0
+--------------------------------------+
Uptime: 503962
pcr-quote: /1RDR4AYADIADENTQTaEYQEDiVbaJXvPhpXBefn8qtyVzMDcNyy+DCWEosmT7gTVQ1fm43uUBdC7hAACEjQAAAAADl3r1QAAANcAAAAAAQABAgAAAAAAAAAAAQAMA/8AAAAwXLu43F9C/nZ7JJxgGADn03XT51lcy7lG6vX83w5MFvE5vu6Un+gHJXB7g89RtR+j
pcr-quote-signature: MGUCMEyTgef326UvqM09y3YRhtjGY5fNUV1g+wIgvAOcNYanTcRnK6Z4FqxiIJFUJ5wfZQIxAPJXXhkYpE/OsiUVvN6/Eyn4jnUScaG9a+6ei31V3s3mUZqCVx9/wmojxBUKN8rWPQ==
pcr-index       pcr-value
  0     jkkHIFe0ce11YQouajSuN0jharqmSlK8dIr4j9TxXDb0PNVE9DjqO8vAh4tqHrl2
  1     wqoQkOVvOepm0+UwHGMmZwOYQl+B1R3TAaCnM3N5spA47EMWEI8cJDv77BvU02Ep
  2     UYkjsPlV0I2gd8lqq6Uiud7O3mHFmc6mxBiJz76krk1QUp2W/k0a/a+2Xn+VvyPE
  3     UYkjsPlV0I2gd8lqq6Uiud7O3mHFmc6mxBiJz76krk1QUp2W/k0a/a+2Xn+VvyPE
  4     lPFWW2vHNA6NX8Iv0J8wWWaT3rAXnNZeRKLtc7LAoEjjNNgX7IxPdyn6WjKBkVP1
  5     TLhFkU36DYM3c75lQ6xSF3C60ebOb4fFGpbaDUuO796OhhJ8dCM69rwNeGxGvGhO
  6     UYkjsPlV0I2gd8lqq6Uiud7O3mHFmc6mxBiJz76krk1QUp2W/k0a/a+2Xn+VvyPE
  7     OoL7f6vUtdwPenkABQg01O0wmynHogAEhtV/YkxizN4Po0CZrfkQfXJf9P6C6h+Y

    The PCR bank is based on SHA384.

    Confirm PCR values reflect expected integrity measurements.

  5. Display the TPM Cisco IdevID certificate.

    Example:

    Router# show platform security tpm attest certificate CiscoECCSUDI location
+--------------------------------------+
   Node location: node0_RP0_CPU0
+--------------------------------------+
Certificate name: Cisco ECC SUDI Root
-----BEGIN CERTIFICATE-----
MIIByDCCAU6gAwIBAgIBAzAKBggqhkjOPQQDAzAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRUNDIFJvb3QgQ0EwIBcNMTMwNDA0MDgxNTQ0WhgPMjA5
OTA5MDcxNjI0MDdaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBF
Q0MgUm9vdCBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABH7Aw7zYG8bzZ5FN1niM
5rV1OQR/L/5g0Kx3KtNtAkFFVGewWLcZv8y9SzZce1uDOOym100wJmGzS4urXg4V
JjtMiKsCcMkiNwJQdcDV1Eg0x79YU/6uy49zIPUGWxKHyqNCMEAwDgYDVR0PAQH/
BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKRFti+jMbF2FbAKGDPK
9q1PPSgEMAoGCCqGSM49BAMDA2gAMGUCMQDwm3Hce0BWn/9hqTq6bfEZEERPiPmA
/6WGbxOJyBl1OZ4OtuiFu58GDQcxEbqAVysCMAi54FIpj4kUhCjHJ4AdmHPqlyxr
MeOEt6xIsdZU1Uk1VMpmJ4969uKxHjiriqXzhg==
-----END CERTIFICATE-----
-----------------Truncated for brevity-----------------

    Validate certificate information as required.

  6. Display TPM ECC-sudi certs information.

    Example:

    Router# show platform security tpm attest certificate CiscoECCSUDI location 0/rp0/CPU0 nonce 1234
+--------------------------------------+
   Node location: node0_RP0_CPU0
+--------------------------------------+
Nonce: 1234
Certificate name: Cisco ECC SUDI Root
-----BEGIN CERTIFICATE-----
MIIByDCCAU6gAwIBAgIBAzAKBggqhkjOPQQDAzAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRUNDIFJvb3QgQ0EwIBcNMTMwNDA0MDgxNTQ0WhgPMjA5
OTA5MDcxNjI0MDdaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBF
Q0MgUm9vdCBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABH7Aw7zYG8bzZ5FN1niM
5rV1OQR/L/5g0Kx3KtNtAkFFVGewWLcZv8y9SzZce1uDOOym100wJmGzS4urXg4V
JjtMiKsCcMkiNwJQdcDV1Eg0x79YU/6uy49zIPUGWxKHyqNCMEAwDgYDVR0PAQH/
BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKRFti+jMbF2FbAKGDPK
9q1PPSgEMAoGCCqGSM49BAMDA2gAMGUCMQDwm3Hce0BWn/9hqTq6bfEZEERPiPmA
/6WGbxOJyBl1OZ4OtuiFu58GDQcxEbqAVysCMAi54FIpj4kUhCjHJ4AdmHPqlyxr
MeOEt6xIsdZU1Uk1VMpmJ4969uKxHjiriqXzhg==
-----END CERTIFICATE-----

Certificate name: Cisco ECC SUDI CA
-----BEGIN CERTIFICATE-----
MIIDETCCApagAwIBAgIBBTAKBggqhkjOPQQDAzAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRUNDIFJvb3QgQ0EwIBcNMTMwNDA0MDgyNjEzWhgPMjA5
OTA5MDcxNjI0MDZaMCsxDjAMBgNVBAoTBUNpc2NvMRkwFwYDVQQDExBBQ1QyIEVD
QyBTVURJIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEjGHc+nnSMQr4zuARzDxH
F6TDi97f7eGqSdDK5misVpoBP0Nwwcmazs+GTiT+Us52/BKuo4JlaZ74cnlzzBIn
kPwtuag2bXSCeYVJhcB3sVuVvYiSKVEi1OIgx85dtXdwo4IBiTCCAYUwDgYDVR0P
AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwfQYIKwYBBQUHAQEEcTBvMD8G
CCsGAQUFBzAChjNodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2Vy
dHMvZWNjcm9vdC5jZXIwLAYIKwYBBQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28u
Y29tL3BraS9vY3NwMB8GA1UdIwQYMBaAFKRFti+jMbF2FbAKGDPK9q1PPSgEMFwG
A1UdIARVMFMwUQYKKwYBBAEJFQETADBDMEEGCCsGAQUFBwIBFjVodHRwOi8vd3d3
LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvcG9saWNpZXMvaW5kZXguaHRtbDBCBgNV
HR8EOzA5MDegNaAzhjFodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kv
Y3JsL2VjY3Jvb3QuY3JsMB0GA1UdDgQWBBSWhzrYiYGRQRUzv+A0jyCPwrvDljAK
BggqhkjOPQQDAwNpADBmAjEAzye9v1h5m/1bAUSU0MQwShDDCRJHXsc+1TtbqOJR
1cZMmhsIzNNy/AskkBoIgNNtAjEAk3DAKxkBx3DYyZS4Uz3B50MpbrZwpxPTUCqW
m7qExCM7m1FjIg98ltfdltPHgqP/
-----END CERTIFICATE-----

Certificate name: Cisco ECC SUDI
-----BEGIN CERTIFICATE-----
MIIDYDCCAuagAwIBAgIKB3VSGUcUMEFBaTAKBggqhkjOPQQDAzArMQ4wDAYDVQQK
EwVDaXNjbzEZMBcGA1UEAxMQQUNUMiBFQ0MgU1VESSBDQTAgFw0yNTA1MjMxNjMy
MjJaGA8yMDk5MDkwNzE2MjQwNVowgaAxJjAkBgNVBAUTHVBJRDo4ODAwLVJQMi1T
IFNOOkZPQzI4NDVOMUJKMQ4wDAYDVQQKEwVDaXNjbzERMA8GA1UECxMIVFBNIFNV
REkxUzBRBgNVBAMTSkNpc2NvIDg4MDAgUm91dGUgUHJvY2Vzc29yIDIgKHNaVFAg
ZGVmYXVsdCkgTUFDOmM0YWI0ZGZmODNjMC0wMDA4ODAwLVJQMi1TMHYwEAYHKoZI
zj0CAQYFK4EEACIDYgAEDXJ5EgjisuoVF9OmqmdPkdSDhm48bwqcsnv4Yb+LTHDE
s84Mdj44a1VIKUEZyVaMemNCu/IdO7TgNcLoizCulb4BxiVIulv4oeL2kh23SxK1
BfW5I5FoxkLz4QGr9fTxo4IBWzCCAVcwDgYDVR0PAQH/BAQDAgXgMAwGA1UdEwEB
/wQCMAAwHwYDVR0jBBgwFoAUloc62ImBkUEVM7/gNI8gj8K7w5YwHQYDVR0gBBYw
FDAIBgZngQULAQEwCAYGZ4EFCwECMIHXBgNVHREEgc8wgcygcQYIKwYBBQUHCASg
ZTBjBgVngQUBAgRaNTM1NDREMjA6NTNkZWM1MmE0YjgwYTczYzViOWJjMDY5ZWM0
MDc5MTZiZjNiMzM4MDoxNmI5ZjllYTIxMTQxZmY4NWMwMjAzY2ZhODEwYzg5NzEw
YjRiOWQ0oFcGCCsGAQUFBwgDoEswSQxAODc5ZWYwMjUxNTlkYTVlMzUzZWEyZTNi
MDhjZGM0MjAzZDUyNzAxNTJjMThlYmRlYjA4Yjc5MzMxYTA3ODQ0ZAYFZ4EFDAEw
HQYDVR0OBBYEFEUV02BniQxfiRTdQVzgfjZh0aD/MAoGCCqGSM49BAMDA2gAMGUC
MQC23df2vMVL9J20W22NzeeBJvU2+awcI10kfcZYSr+SLA+BTHU/iLyUIatZpqcv
Y7UCMA3xchuT66IPNfkrjZoPSQARUP0376dirxOiFSwcedUGVDxzMxObGb3Lh68H
hpBtQA==
-----END CERTIFICATE-----

    Review details for completeness and correctness.

  7. Display the TPM IAK certificate.

    Example:

    Router# show platform security tpm attest certificate CiscoECCIAK location 0/rp0/CPU0 nonce 1234
+--------------------------------------+
   Node location: node0_RP0_CPU0
+--------------------------------------+
Nonce: 1234
Certificate name: Cisco ECC IAK Root
-----BEGIN CERTIFICATE-----
MIIByDCCAU6gAwIBAgIBAzAKBggqhkjOPQQDAzAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRUNDIFJvb3QgQ0EwIBcNMTMwNDA0MDgxNTQ0WhgPMjA5
OTA5MDcxNjI0MDdaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBF
Q0MgUm9vdCBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABH7Aw7zYG8bzZ5FN1niM
5rV1OQR/L/5g0Kx3KtNtAkFFVGewWLcZv8y9SzZce1uDOOym100wJmGzS4urXg4V
JjtMiKsCcMkiNwJQdcDV1Eg0x79YU/6uy49zIPUGWxKHyqNCMEAwDgYDVR0PAQH/
BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKRFti+jMbF2FbAKGDPK
9q1PPSgEMAoGCCqGSM49BAMDA2gAMGUCMQDwm3Hce0BWn/9hqTq6bfEZEERPiPmA
/6WGbxOJyBl1OZ4OtuiFu58GDQcxEbqAVysCMAi54FIpj4kUhCjHJ4AdmHPqlyxr
MeOEt6xIsdZU1Uk1VMpmJ4969uKxHjiriqXzhg==
-----END CERTIFICATE-----

Certificate name: Cisco ECC IAK CA
-----BEGIN CERTIFICATE-----
MIIDIzCCAqmgAwIBAgIJBEje0ku4AXhYMAoGCCqGSM49BAMDMCwxDjAMBgNVBAoT
BUNpc2NvMRowGAYDVQQDExFDaXNjbyBFQ0MgUm9vdCBDQTAgFw0yNDAxMTAxOTM3
NDdaGA8yMDk5MDExMDE5Mzc0N1owQTEOMAwGA1UEChMFQ2lzY28xDjAMBgNVBAsT
BVJvYnVyMR8wHQYDVQQDExZFQyBQMzg0IEF0dGVzdGF0aW9uIENBMHYwEAYHKoZI
zj0CAQYFK4EEACIDYgAEOyud77njuBar/GPcZtH7TIai4XAY7B6hftiadq3oj7+e
xGeAqes3K3IMVE17TNDkTLVTNoqIKTV50g6noezuXsOD/9zEwll2fsbzuzt1KFVr
bop5Pyq7HK5PI+dmRFjgo4IBfjCCAXowDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB
/wQIMAYBAf8CAQAwfQYIKwYBBQUHAQEEcTBvMD8GCCsGAQUFBzAChjNodHRwOi8v
d3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvZWNjcm9vdC5jZXIwLAYI
KwYBBQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28uY29tL3BraS9vY3NwMB8GA1Ud
IwQYMBaAFKRFti+jMbF2FbAKGDPK9q1PPSgEMFEGA1UdIARKMEgwRgYJKwYBBAEJ
FQFVMDkwNwYIKwYBBQUHAgEWK2h0dHA6Ly93d3cuY2lzY28uY29tL3NlY3VyaXR5
L3BraS9wb2xpY2llcy8wQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL3d3dy5jaXNj
by5jb20vc2VjdXJpdHkvcGtpL2NybC9lY2Nyb290LmNybDAdBgNVHQ4EFgQUQuOx
5As0KbV+3dYMwPGomM/QrKEwCgYIKoZIzj0EAwMDaAAwZQIwWlteUTHSxAe6d3Gp
T9E1HZGX+oAQSijo/dPWSkhdbchO+Fe6M9bzjb+gvaUt/EBDAjEAoDLC0H4/JW3i
6jElqnEYqD6GWiiQALvz0Zop6JI897nD/WJvsjnPGgMfxtNDfq3H
-----END CERTIFICATE-----

Certificate name: Cisco ECC IAK
-----BEGIN CERTIFICATE-----
MIIDdzCCAvygAwIBAgIKBWSFFBERQYNRaTAKBggqhkjOPQQDAzBBMQ4wDAYDVQQK
EwVDaXNjbzEOMAwGA1UECxMFUm9idXIxHzAdBgNVBAMTFkVDIFAzODQgQXR0ZXN0
YXRpb24gQ0EwIBcNMjUwNTIzMTYzMjIyWhgPMjA5OTAxMTAxOTM3NDZaMIGgMSYw
JAYDVQQFEx1QSUQ6ODgwMC1SUDItUyBTTjpGT0MyODQ1TjFCSjEOMAwGA1UEChMF
Q2lzY28xETAPBgNVBAsTCFRQTSBTVURJMVMwUQYDVQQDE0pDaXNjbyA4ODAwIFJv
dXRlIFByb2Nlc3NvciAyIChzWlRQIGRlZmF1bHQpIE1BQzpjNGFiNGRmZjgzYzAt
MDAwODgwMC1SUDItUzB2MBAGByqGSM49AgEGBSuBBAAiA2IABInu07M6N/F10hLw
A4KsafCGzqkeft/5nR3awykGZfzRvOAZC3U6mnXniJezgVoEATTnGFO6sQZZSMFO
xrBDdLmNkMlY7Neq/8pC/rqDoFGJi+oD4jOSdTD+Lgj+3XfRi6OCAVswggFXMA4G
A1UdDwEB/wQEAwIF4DAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFELjseQLNCm1
ft3WDMDxqJjP0KyhMB0GA1UdIAQWMBQwCAYGZ4EFCwEBMAgGBmeBBQsBAzCB1wYD
VR0RBIHPMIHMoHEGCCsGAQUFBwgEoGUwYwYFZ4EFAQIEWjUzNTQ0RDIwOjUzZGVj
NTJhNGI4MGE3M2M1YjliYzA2OWVjNDA3OTE2YmYzYjMzODA6MTZiOWY5ZWEyMTE0
MWZmODVjMDIwM2NmYTgxMGM4OTcxMGI0YjlkNKBXBggrBgEFBQcIA6BLMEkMQDg3
OWVmMDI1MTU5ZGE1ZTM1M2VhMmUzYjA4Y2RjNDIwM2Q1MjcwMTUyYzE4ZWJkZWIw
OGI3OTMzMWEwNzg0NGQGBWeBBQwBMB0GA1UdDgQWBBT4wBA1PZL4Nz6AtQ4p/tXV
ZM5MHTAKBggqhkjOPQQDAwNpADBmAjEAlvOCAK8orDACly8G67vmtkPpt3tNL47F
1p6OoHNh0DSn7CNhbonVuslq8cRpZTVbAjEA/YC0I0EGTxRkVquPYtByiJVXHLOX
pUDdcb4/1BilpLgq3Ypaec4lF2v0wqPNZvw3
-----END CERTIFICATE-----

TPM is verified as enabled and correctly configured. All relevant certificate and integrity information is confirmed and available for compliance purposes.