Accept an unrecognized device with an unsupported TPM and add its CA to the trusted list as "Manually added"
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
- Domain
- authentication, security
Research direction
Begin with the device enrollment and attestation posture-check paths, then trace device status display, Accept TPM controls, EK CA settings, and activity logging. Use the listed test scenarios to validate unknown-device rejection, manual acceptance, CA reuse, and quarantined-device restrictions. Resolve the open questions about declining devices and removing manually added CAs before implementation.
Written by the indexing model from the issue text.
Description
User story
As an admin, I want to accept devices whose TPM isn't in Defguard's CA database, so that users with unsupported hardware can pass attestation.
Acceptance criteria
- A device whose EK certificate doesn't chain to a CA in the database gets the status "Unrecognized" in the Devices list, the drawer and the user profile.
- Unrecognized devices fail attestation posture checks.
- The "Accept TPM" action is in the row menu and the drawer, only for Unrecognized devices.
- The action opens a confirmation modal explaining that the TPM's CA will be trusted for all future devices.
- After accepting, the device becomes "Attested manually", and the CA appears in the Settings EK CA list (US1) with a "Manually added" badge.
- Later devices with a TPM from the same CA become "Attested" automatically.
- The Activity log records the acceptance.
Test scenarios
- Enroll a device with an unknown TPM → its status is Unrecognized and it's rejected by an attestation posture check.
- Accept its TPM → the device becomes Attested manually and can connect.
- Open Settings › Device Attestation → the new CA is listed with the Manually added badge.
- Enroll a second device with the same TPM → it becomes Attested with no admin action.
- For a device that isn't quarantined → "Accept TPM" isn't available.
Notes
- Store the issuing CA from the device's EK certificate chain when accepting.
Open questions
- Can an admin decline a quarantined device? The design shows a "Declined" status.
- Can a manually added CA be removed, and what happens to devices already attested through it?
- Dominant language
- Rust
- Stars
- 2.9k
- Forks
- 121
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 59
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from DefGuard/defguard
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
DefGuard/defguard#3851 · 2 comments ·
Maintainers usually reply within 1 day
-
Incorrect "Edit workflow" label for MFA flow formPossibly taken @j-chmielewski claimed this 1 day ago. Openbug
Difficulty 1/5 Under an hour Newbie friendliness 78/100
DefGuard/defguard#3844 · 1 assignee ·
Maintainers usually reply within 1 day
-
Invalid hover on the OS delete in posture check edit formPossibly taken @jakub-tldr claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
DefGuard/defguard#3842 · 1 assignee ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
DefGuard/defguard#3751 · 1 assignee ·
Maintainers usually reply within 1 day
All issues in DefGuard/defguard
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
cmlarsen/writemorebetter#158 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
-
state:triage-needed
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
scanaislop/aislop#482 ·
Maintainers usually reply within 1 day
-
docs(skills): issue-first should reference an existing Linear ticket instead of filing a duplicateOpendocumentation
Difficulty 1/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day