03 — Access Control
Device authentication:
Hardware, not passwords
The relay is not publicly accessible.
Why hardware attestation
The access chain
01
MDM enrols device
→
02
ACME provisions P-384 in Secure Enclave
→
03
Apple attests key is in genuine SE
→
04
h2o requires client cert on QUIC connect
→
05
Device accesses relay
What gets stopped
| Scenario | Result |
|---|---|
| Unmanaged device (no cert) | Silent QUIC rejection |
| Managed device, cert revoked | Immediate rejection |
| Cert copied to another device | Impossible — hardware-bound |
| Known relay address, no cert | QUIC handshake fails |