Deploy VTA appliance

By the end of this guide, you will have a VTA deployed through Affinidi Portal, with PNM connected to it. Affinidi hosts and operates the VTA in one of two modes, compared in Which mode to choose:

• Shared: runs on a shared network. Evaluation and development purposes only. Offered on every plan, and the only mode on the free Essential and Community plans.
• Isolated: runs in an AWS Nitro Enclave, a Trusted Execution Environment (TEE). Hardware-rooted attestation, keys and data. Offered on the Standard and Enterprise plans.

Already have a running VTA? Skip to Create your first context. To run the VTA yourself, see Self-hosted (open source).

Prerequisites

• An Affinidi Portal account with access to the target project.
• A project with no VTA configuration yet. Each project holds one.
• Rust 1.95 or later, to compile the PNM CLI.

Step 1. Install the PNM CLI

The Personal Network Manager (PNM) CLI is how you connect to and manage your VTA. Both modes use the same version:

cargo install pnm-cli@0.45.0 --locked --registry crates-io

Run pnm help to confirm it installed. Then follow the steps for your mode below, starting at Step 2.

Deploy in Shared mode

You create your own Administrator DID with PNM, give it to Affinidi Portal when you create the VTA, then connect PNM to the VTA with it.

Step 2. Create your Administrator DID

Pick a short local name for this VTA, its VTA slug, such as my-vta, and run:

pnm setup --name my-vta

Copy the Admin DID from the output, which starts:

Pending VTA 'my-vta' created.
  Admin DID: did:key:z6MkjLfAT61ZbMfUTytxjp6KnDh7hy9jE5YkQJNuouJEC4cU

The output then suggests setting admin_did in a setup.toml file. That hint is for self-hosted VTAs: here, you enter the Admin DID in Affinidi Portal in the next step.

PNM keeps the DID’s private key in your OS keyring, so run Step 4 on this same machine.

Step 3. Create the VTA in Shared mode

Open the create form

In Affinidi Portal , go to Verifiable Trust Agent and click Create configuration.

Set the configuration fields

Set these fields, and leave the others at their defaults:

Field	What to enter
Appliance type	Shared. On the free plans, it is already selected.
Administrator DID	The did:key you created with pnm setup.
Mediator DID - optional	One of this project’s mediators, or ＋ Enter custom mediator DID. To deploy one, see Deploy an Affinidi-hosted mediator.

Fixed after creation

Appliance type, Appliance size, and Mediator DID can’t be changed later. Add a mediator now if you want to back up this VTA: backups need DIDComm.

Create the VTA

Click Create, wait for the status to show Complete, then copy the VTA DID from the configuration page.

Mediator in Explicit Allow mode

If your mediator’s Mediator ACL mode is Explicit Allow, add the VTA DID to its allow list: in DIDComm Mediator, open its configuration, click Edit under Access Controls, then Add DID, paste the VTA DID into User’s DID, and click Save. Check the DID first: Portal keeps a saved DID permanently. The default, Explicit Deny, needs no change.

Step 4. Connect PNM to the VTA

pnm setup continue my-vta --vta-did <vta-did>

PNM confirms that the VTA accepts your Administrator DID, then replaces it with a fresh long-lived key. The output includes:

Ready: try `pnm health`.

Deploy in Isolated mode

Standard and Enterprise plans only

The Isolated appliance type is available on the Standard and Enterprise plans, which are custom plans. To use it, contact Affinidi. On the free Essential and Community plans, deploy in Shared mode instead.

You create a one-time bootstrap claim DID with PNM and give it to Affinidi Portal when you create the VTA. PNM then bootstraps against the VTA: it checks the enclave’s attestation against the measurement you pin, and only if they match does it create your Administrator DID on your machine and hand the VTA’s first administrator role over to it.

Step 2. Create the VTA in Isolated mode

Create a bootstrap claim DID

pnm bootstrap claim-did create

Copy the did:key it prints: you enter it in Affinidi Portal, and pass it to PNM in Step 3. PNM keeps its private key in your OS keyring, so run Step 3 on this same machine.

Open the create form

In Affinidi Portal , go to Verifiable Trust Agent and click Create configuration.

Set the configuration fields

Set these fields, and leave the others at their defaults:

Field	What to enter
Appliance type	Isolated, the default on the Standard and Enterprise plans.
Bootstrap claim DID	The did:key you created with pnm bootstrap claim-did create.
Mediator DID - optional	One of this project’s mediators, or ＋ Enter custom mediator DID. To deploy one, see Deploy an Affinidi-hosted mediator.
Appliance size	Enhanced, or Advanced on the Enterprise plan. See which sizes your plan includes.

Fixed after creation

Appliance type, Appliance size, and Mediator DID can’t be changed later. Add a mediator now if you want to back up this VTA: backups need DIDComm.

Create the VTA

Click Create, wait for the status to show Complete, then note the VTA DID on the configuration page.

Mediator in Explicit Allow mode

If your mediator’s Mediator ACL mode is Explicit Allow, add the VTA DID to its allow list: in DIDComm Mediator, open its configuration, click Edit under Access Controls, then Add DID, paste the VTA DID into User’s DID, and click Save. Check the DID first: Portal keeps a saved DID permanently. The default, Explicit Deny, needs no change.

Copy the bootstrap command

Copy it from the Verify the enclave before you bootstrap alert on the configuration page. If you dismissed the alert, click Show bootstrap instructions.

Step 3. Bootstrap PNM against the VTA

Paste the command you copied, and add --claim-did with the claim DID from Step 2 unless the command already includes it. Add --slug my-vta to give the VTA a short name in PNM, its VTA slug. Run it on the machine where you created the claim DID:

pnm bootstrap connect --vta-did did:webvh:QmVE1TQeCtg3aavpTqasqencJpagRr8JKdGRyoZ5Qx6kRp:your-appliance.vta.affinidi.io --expect-pcr0 8f1d3c5a7b9e...c9a1f3b5 --expect-pcr8 4b2e9d6f0a1c...a7c1e0d2 --claim-did did:key:z6Mk... --slug my-vta

Check that the output shows (pinned ✓) next to PCR0, followed by Bootstrap complete.. That confirms the enclave runs the build you pinned. The VTA first enrols your claim DID as a temporary administrator. PNM then creates your Administrator DID on this machine, hands the administrator role over to it, and deletes the claim key: the Admin DID line under Bootstrap complete. shows the new DID. For what the pins check, see PCR0 pinning.

One attempt per VTA

Each VTA accepts one bootstrap, so keep --expect-pcr0 in the command. If PNM reports a PCR0 mismatch, treat the VTA as untrusted and replace it, as described in Troubleshooting. If the run stops after TEE attestation verified., run the same command again on the same machine within 24 hours: PNM resumes the hand-over.

Confirm

Whichever mode you deployed, check the connection:

pnm --vta my-vta health

Replace my-vta with your VTA slug. Every check should show ✓. Client DID is the long-lived did:key PNM now authenticates with, not the DID from Step 2. This sample is from a VTA with a mediator:

  VTA: my-vta
  DID: did:webvh:QmVE1TQeCtg3aavpTqasqencJpagRr8JKdGRyoZ5Qx6kRp:your-appliance.vta.affinidi.io

── VTA ───────────────────────────────────────────
  DID           did:webvh:QmVE1TQeCtg3aavpTqasqencJpagRr8JKdGRyoZ5Qx6kRp:your-appliance.vta.affinidi.io
                ✓ resolves (webvh)
  Mode          DIDComm + REST
  URL           https://your-appliance.vta.affinidi.io (from DID)
  Service       ✓ ok

── Authentication ────────────────────────────────
  Client DID    did:key:z6Mk...
  Token         ✓ valid (expires in 899s)

── Mediator ──────────────────────────────────────
  DID           did:webvh:QmSW59XWpXN4xNX5ZJvkYmaJBpBH7d1WN1fR6ZZG8xtjGE:your-appliance.mediator.affinidi.io
                ✓ resolves (webvh)
                ✓ pong (14ms)

── VTA DIDComm ───────────────────────────────────
  Trust-ping    ✓ pong (25ms)

The output above is abridged. Between Authentication and Mediator, pnm health also prints a Deployment section with these rows:

• Sealed: whether the VTA is sealed.
• Storage: whether the VTA’s storage is encrypted at rest.
• TSP: whether TSP is enabled.
• TEE: the TEE type and whether it is detected, on a VTA that runs in a TEE.
• Version: the VTA version, shown to administrators only.
• Restored: whether the VTA’s state was restored from a backup, shown to administrators only.

If any check shows ✗, see Troubleshooting below.

PNM treats the first VTA you register on a machine as its default, and --vta picks a specific VTA for a single command. To make this VTA the default for every later command, run pnm vta use my-vta. pnm vta list shows every VTA registered on this machine.

Troubleshooting

Next steps