---
title: "Follow Matter's attestation and · Agent Wranglers"
url: https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/matter-attestation
id: IOT-41
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1138
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Follow Matter's attestation and commissioning in full

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: IOT-41
- Level: Recommended
- Chapter: [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md)
- Rule: A Matter device carries its own device attestation certificate, chained through your product attestation intermediate to an approved root. It commissions only with a random setup passcode that is not one of the trivial values the specification forbids.
- Check: A factory test reads each unit's attestation chain and verifies it up to an approved root. A job over production records fails on any passcode in the forbidden list or shared by two units. A commissioning test with a controller completes, and a test with a device certificate from another vendor's chain fails.
- How: Matter controllers check the device's attestation chain and its certification declaration before they add it to a home. A cloned or uncertified device then fails at the door. Generate each device attestation key on the chip, as [keep each device's private key in secure hardware](https://agentwranglers.se/playbook/connected-devices/device-identity/key-in-secure-hardware.md) says. Publish the product's certification on the Distributed Compliance Ledger before the first unit ships. The passcode is the setup code from [claim a device with a one-time code](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/claim-codes.md), so generate it at random per unit. Never use 12345678, 87654321 or eight repeated digits. Close the commissioning window after the time the specification allows.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
FORBIDDEN_PASSCODES = {12345678, 87654321} | {int(str(digit) * 8) for digit in range(10)}

def passcode_problems(passcodes_by_serial: dict[str, int]) -> list[str]:
    problems = [f"{serial} uses a forbidden passcode" for serial, code in passcodes_by_serial.items() if code in FORBIDDEN_PASSCODES]
    if len(set(passcodes_by_serial.values())) < len(passcodes_by_serial):
        problems.append("two units share a passcode")
    return problems
```

### Go example

```go
func isForbiddenPasscode(code uint32) bool {
	if code == 12345678 || code == 87654321 {
		return true
	}
	return code%11111111 == 0 && code/11111111 <= 9
}

func PasscodeProblems(passcodes map[string]uint32) []string {
	var problems []string
	seen := map[uint32]bool{}
	for serial, code := range passcodes {
		if isForbiddenPasscode(code) {
			problems = append(problems, serial+" uses a forbidden passcode")
		}
		if seen[code] {
			problems = append(problems, "two units share a passcode")
		}
		seen[code] = true
	}
	return problems
}
```

## Sources

- [Connectivity Standards Alliance, Matter](https://csa-iot.org/all-solutions/matter/)

## Related rules

- IOT-2 [Keep each device's private key in secure hardware](https://agentwranglers.se/playbook/connected-devices/device-identity/key-in-secure-hardware.md) in Connected devices
- IOT-6 [Claim a device with a one-time code instead of its serial number](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/claim-codes.md) in Connected devices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/matter-attestation">Agent Wranglers connected devices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Factory reset erases every owner's data and keys](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/factory-reset.md)
- Next: [Pair Bluetooth LE with LE Secure Connections](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/ble-secure-connections.md)
- [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md)