domains / families / security / validating-tpm-measured-boot-attestation

validating-tpm-measured-boot-attestation

separate

Verifies TPM 2.0 measured-boot integrity and remote attestation with

When to use

• Establishing that endpoints/servers booted a known-good firmware and kernel before granting access (Zero Trust device posture).
• Detecting boot-chain tampering (bootkits, unauthorized firmware/kernel changes) via PCR drift from a baseline.
• Verifying measured-boot integrity after a Secure Boot or firmware incident.
• Sealing secrets (disk keys, credentials) to a measured-boot state so they only release on a trusted boot.
• Building or auditing a remote-attestation service (e.g., Keylime, custom verifier).

When not to use

• Clearing the TPM
• Taking ownership of the TPM
• Defining NV indices

Skill page

Source