FDO troubleshooting reference

This reference identifies common issues and provides solutions for FIDO Device Onboard (FDO) initialization and onboarding. Use these resolutions and diagnostic commands to resolve configuration issues and ensure a successful ownership transfer.

Error / Issue Common Cause Resolution

TO1 failed

The Rendezvous (RV) server has no record of the device.
  1. Verify the transfer of the ownership voucher to the Owner server.
  2. Confirm the Owner server registered the device with the RV server.
  3. Verify the Owner server targets the correct RV address.
  4. Match the voucher GUID with the device GUID by using the go-fdo-client print command.

no rendezvous information found…​

Missing RV metadata in the device credential.
  1. Use the go-fdo-client print command to verify RV information in the credential.
  2. Configure the Manufacturer server with the correct RV data.
  3. Re-initialize the device.

TLS Errors

Self-signed certificates or untrusted Certificate Authority (CA) chains.

Use the --insecure-tls flag for the device-init or onboard commands. Use this flag only in test environments.

Failed to read credential from TPM

Missing or invalid credential in the Trusted Platform Module (TPM) non-volatile (NV) index.

Run the device-init --tpm command to provision the credential first.

Permission denied on /dev/tpmrm0

Insufficient user privileges for TPM access.

Run the command with sudo.

TPM NV index corrupted or inaccessible

Inconsistent TPM state.
  1. Clear the index by using the tpm2_nvundefine 0x01D10001 command.
  2. Re-run device-init.

Diagnostic commands:
Copy link

To further investigate persistent issues, use the following commands to gather metadata or verbose logs.

Print device GUID and metadata:

For file-based credentials:

$ sudo go-fdo-client print --blob /boot/device_credential

For TPM-based credentials:

$ sudo go-fdo-client print --tpm /dev/tpmrm0

Enable verbose debugging:

Add the --debug flag to your command to inspect the HTTP request and response payloads between the client and servers:

$ sudo go-fdo-client onboard --blob /boot/device_credential --key ec256 --kex ECDH256 --debug
Note

Most TO1 failures result from timing issues or a mismatch between the Manufacturer’s programmed Rendezvous info and the location where the Owner server uploaded the voucher. Always verify that the "Rendezvous Server Info" in your manufacturing.yaml file matches the live RV server address.