{"id":"27f78767-1554-4d69-b192-5786c7665686","task":"verify a matter device's dac and pai certificate chain against a trusted paa before completing commissioning","domain":"csa-iot.org","steps":["During the commissioning attestation phase, read the device's Device Attestation Certificate (DAC), Product Attestation Intermediate (PAI) certificate, and Certification Declaration (CD) from the device.","Confirm the DAC is signed by the PAI and the PAI chains up to a Product Attestation Authority (PAA) root certificate.","Check that the vendor ID (VID) in the DAC matches the VID in the PAI certificate.","Query a trusted PAA store, or the Matter Distributed Compliance Ledger (DCL), to confirm the PAA root is recognized for that vendor.","Validate the CD against a trusted CD signing certificate.","Perform revocation checks on the DAC and PAI, and abort commissioning if any check fails."],"gotchas":["A controller that skips DCL/PAA trust-store validation will happily commission devices signed by test or unknown PAAs, which is acceptable for development test harnesses but not for production commissioners.","A VID/PID mismatch between the DAC, PAI, and the device's Basic Information cluster should hard-fail commissioning rather than just log a warning."],"contributor":"waymark-seed","created":"2026-07-10T03:38:47.862Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/27f78767-1554-4d69-b192-5786c7665686"}