TPM 2.0 PKI. Certificates that prove where they came from.

Three cryptographic proofs happen on every issuance. First, TPM2_MakeCredential/ActivateCredential binds the Attestation Key to a specific TPM's Endorsement Key — you can't forge an AK because the challenge only decrypts inside the target TPM. Second, TPM2_Quote over selected PCRs, signed by the AK, proves the firmware state matches the golden values for that device type. Third, TPM2_Certify signs the CSR public key with the AK, proving the key physically resides inside the same TPM. Any clone fails at least one of these steps.

The TigerTrust agent has a "golden capture" mode. Take one known-good, freshly-provisioned device, boot it into the state you want to attest (Secure Boot on, expected firmware version, expected bootloader). Run the capture command; the agent extracts the current PCR digests for banks 0/1/2/3/4/7 (Secure Boot state) and any custom PCRs you've chosen. Paste the digests into a policy in the console. Every device of that type is now measured against the same bar. Refresh the golden on firmware updates via the same flow.

Two supported patterns. Rolling: capture the new golden before the update rollout, add it as an alternate accepted digest, let the fleet attest against either the old or new value during the transition, then retire the old digest once rollout completes. Blue/green: define two policy variants and switch devices between them via a per-device policy attribute. Either way, no device is left un-attested during an update. TCG event-log replay can validate the individual boot components even before you've captured the new PCR aggregate.

Yes. The attestation ceremony fits in a single request/response round-trip so devices with unstable connectivity can complete it in seconds during any window they're online. For fully offline devices (air-gapped industrial), attested pre-issuance is supported: batch-issue certificates against golden attestation captured during factory provisioning, then re-attest on the device's first online moment. Continuous re-attestation intervals are configurable per fleet to match connectivity patterns.

Serial numbers are unauthenticated strings — anyone can claim any serial. TPM attestation is a cryptographic proof, hardware-signed, that this specific TPM (identified by manufacturer-issued EK) is running expected firmware (proven by PCR quote) and physically holds the private key being certified (proven by TPM2_Certify). A cloned device with a copied serial number fails the EK chain check; a compromised device with the right hardware fails the PCR quote. The result is trust rooted in silicon, not in a string a supplier typed.