App Attestation
In Matter Casting, app attestation is the process Fire TV uses to verify the identity and certification status of your mobile app (client). This process uses the same attestation credentials mechanism defined in the Matter specification, applied here to identify your client rather than a physical device.
When your client connects to a Fire TV (player) for the first time (a process called commissioning), it provides attestation credentials through the Matter Casting SDK. These credentials prove two things:
- The client is associated with the vendor and product identity it claims to represent.
- The client has been certified by the Connectivity Standards Alliance (CSA).
Fire TV validates these credentials and establishes the client's verified vendor and product identity. It then matches that identity against the access declarations of installed Fire TV content apps to determine which content apps the client is allowed to access. For example, the Foo TV content app on Fire TV declares that clients with the vendor and product ID for Foo-A and Foo-B can access it. When your client connects and attests with the vendor and product ID associated with Foo-A, Fire TV verifies its credentials and grants it access to the Foo TV content app.
The following sections cover the attestation credentials your client needs, the certificate chain that supports them, how to obtain them, and how to certify your client with the CSA. Once you have your credentials, see Matter Casting Integration for how to configure your client.
- Attestation credentials: Device Attestation Certificate and Certification Declaration
- Device Attestation Certificate Chain
- How to obtain a DAC and CD for your app
- Certifying an app with the CSA
- Next step
- Related topics
Attestation credentials: Device Attestation Certificate and Certification Declaration
During commissioning, your client proves its identity using two credentials: its Device Attestation Certificate (DAC) and a Certification Declaration (CD). Together, these allow Fire TV to verify that your client is certified and belongs to the vendor it claims to represent.
DAC: The DAC is a certificate containing your Vendor ID and Product ID that identifies your client within the attestation chain. Your client uses the DAC during commissioning to prove it is associated with the vendor and product identity it claims to represent.
CD: The CD is a file signed by the CSA, showing that the product is certified. The CD includes the CSA-issued vendor ID for the product maker, and a product ID issued by the product maker to identify the product. The CD also includes fields that constrain which certificate chain is authorized for the product, such as the Vendor ID and Product ID that the signing PAI must carry.
The result for Casting is that the player reads both CD and DAC from your client to verify three things:
- The DAC chains up to an approved PAA, proving that a legitimate authority issued it.
- The CD is validly signed by the CSA, proving that the product is certified.
- The Vendor ID and Product ID in the CD match those in the DAC, linking the certification to the correct certificate chain.
This allows the player to verify that the product is made by the company it claims to be and certified by the CSA.
Device Attestation Certificate Chain
The Device Attestation Certificate Chain is the hierarchy of certificates that allows Fire TV to trace your client's DAC back to a trusted source. A DAC alone is not enough because Fire TV needs to verify who issued it and whether that issuer is legitimate.
The chain has three levels, from the trusted root at the top down to your client's certificate:
| Level | Name | Definition |
|---|---|---|
| 1 | Product Attestation Authority (PAA) | A self-signed root certificate that serves as the trust anchor. The CSA maintains a Distributed Compliance Ledger (DCL) listing all approved PAA certificates. TVs periodically cache this list to validate attestation chains. |
| 2 | Product Attestation Intermediate (PAI) | An intermediate certificate signed by a PAA. Each PAI is assigned to a specific Vendor ID and may optionally be scoped to a single Product ID. A vendor can create one PAI per product, one for a group of products, or one for all products. If a PAI covers multiple products, it must not include a Product ID, or attestation will fail. |
| 3 | Device Attestation Certificate (DAC) | A leaf certificate unique to your app, signed by your PAI. The DAC contains your Vendor ID and Product ID and is paired with a private key that your app uses to prove its identity. The chain of trust flows from your app's DAC up through the PAI to the PAA. |
During commissioning, validation proceeds upward through the chain. Fire TV verifies the DAC's signature using the public key in the PAI certificate. It then verifies the PAI certificate's signature using the public key in the PAA certificate. Finally, Fire TV confirms that the chain terminates at an approved PAA certificate in the trusted root list that Fire TV obtains from the CSA's DCL.
How to obtain a DAC and CD for your app
To obtain a DAC, you can either manage your own DAC certificate chain or use a third-party tool that signs DACs.
- Manage a certificate chain yourself. This means you manage your own PAA and PAI and sign DACs directly. This path requires CSA membership of either Participant or Promoter level, as well as compliance with the CSA Certificate Policy, which describes roles and responsibilities for the management of Certificate Authority certificates for CSA products. Compliance is demonstrated by completing the CSA’s Certificate Policy Statement, where the member explains how they comply with it. An outside expert hired by the CSA reviews these statements.
-
Use a third party tool to sign DACs. This means a third-party signing service operates the PAA and PAI on your behalf. Any CSA membership level works for this approach. There are a number of companies that manage certificates for DAC signing, and can agree to host dedicated Intermediate Certificates or a dedicated Root Certificate for a customer. Typically these provide a cloud API to sign a Certificate Signing Request issued by your client. The following is a non-exhaustive list of companies that offer cloud-based DAC signing services that can be used for Matter Casting:
To obtain a CD, a product maker must certify their product with the CSA. Upon successful certification, the CSA issues a CD for your product.
- Run full certification testing. Include its own implementation of Matter and run the result through Matter Certification tests using an Authorized Test Lab (ATL).
- Use a certified software component. Include a software component library that has already received software component certification. To obtain CSA certification, the product maker fills out CSA paperwork and submits it to the CSA with either the ATL test report or information about the certified software component it uses. Amazon offers both iOS and Android certified software components for Matter Casting partners to use. To obtain certification, a product maker must be a member of the CSA at one of the membership levels (Promoter, Participant, Adopter, or Associate). There is a fee associated with certification, which varies by membership level.
For more about Membership Levels, see CSA Membership.
Certifying an app with the CSA
The following section outlines the key steps to certify your app with the CSA and obtain your CD. For a detailed explanation of the certification process, see the "Certification Process" section on the CSA Website.
- Join CSA. Choose a membership level and join the CSA.
- Request a Manufacturer ID or Vendor ID.
- Submit a Certification Application along with payment. See the following example documents for a client, which uses the certified software component provided by Amazon:
- Upon Approval, the CSA provides a CD which contains the Vendor ID and Product ID from your certification.
Next step
For implementation details, including where to embed your DAC and CD in your app's manifest, see Matter Casting Integration.
Related topics
Last updated: Jul 24, 2026
