I would like to verify a hardware-backed key pair in my Java backend service.

According to the Verifying hardware-backed key pairs with Key Attestation page, I need to verify the attestation object against the Google Root Certificates list.

I don't want to hardcode this list in my codebase as it makes it less flexible and I'd have to keep it up to date manually.

Is there an endpoint to fetch this list dynamically? I see a similar endpoint for the Certificate Revocation Status List

  • Also posted on Stack Overflow: stackoverflow.com/q/73557927/2821954
    – Andrew T.
    Jan 13 at 13:40
  • As this question is only about hardware verification root CAs (which are used on the server side) it is clearly a development question and thus OT here.
    – Robert
    Jan 13 at 16:00


You must log in to answer this question.

Browse other questions tagged .