c8s live enclave verifier

Verifies a remote confidential-Kubernetes node in your browser with c8s-verify, then chats through the attested, over-encrypted tunnel. A thin relay terminates the cluster's internal mesh TLS and serves this page same-origin — trust still comes from the attestation this page checks, not the TLS.

platform bare-metal Intel TDX  ·  freshness required  ·  MRTD pinned
  1. Pin cluster mesh CA
    fetch /.well-known/mesh-ca.pem and pin it as the trust anchor
  2. Attest & verify hardware
    nonce → TDX quote → DCAP chain to Intel SGX Root CA, report_data binds the serving cert + nonce, MRTD pinned, cds-cert chains to the mesh CA
  3. Establish PQ channel
    X25519 + ML-KEM-768 handshake → AES-256-GCM tunnel
over the attested tunnel