Android Key Attestation settings
Android Key Attestation is an optional device binding feature for Android devices. It lets Advanced Identity Cloud verify that the keys used by a bound device are valid, haven’t been revoked, and are stored in hardware-backed security storage.
This feature only applies when a journey uses the Device Binding node with Android Key Attestation enabled.
It applies to devices running Android N (24) or later.
Advanced Identity Cloud doesn’t perform attestation for non-Android devices, and Android Key Attestation isn’t supported when the Device Binding node uses the Application PIN Authentication Type.
When Android Key Attestation is enabled, Advanced Identity Cloud verifies the device’s attestation certificate chain using Google’s hardware attestation root certificates and certificate revocation status information.
Configure Android Key Attestation settings
-
In the Advanced Identity Cloud admin console, go to Authentication > Identity Verification.
-
Click Android Key Attestation.
-
If the configuration is not already enabled, click Enable Android Key Attestation to create it with default settings before configuring it.
-
Configure the following settings:
- Certificate revocation status list URL
-
The URL to retrieve the certificate revocation status list (CRL).
Keys are checked against the revocation status list to ensure they haven’t been revoked or suspended. They can be revoked for a number of reasons, including mishandling or suspected extraction by an attacker.
Defaults to
https://android.googleapis.com/attestation/status(a list maintained by Google). - Google hardware attestation root certificate URL
-
The URL for retrieving the Google hardware attestation root certificates.
Learn more in Verifying hardware-backed key pairs with Key Attestation in the Android developer documentation.
If you don’t provide a URL, you must map the certificate using the secret label
am.services.attestation.google.public.key.Learn more in Use ESVs for signing and encryption keys.
-
Click Save.