diff --git a/apex/Android.bp b/apex/Android.bp
index e39b459..1c4d357 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -92,6 +92,8 @@
         "microdroid_initrd_normal",
         "microdroid.json",
         "microdroid_kernel",
+        // rialto_bin is a prebuilt target wrapping the signed bare-metal service VM.
+        "rialto_bin",
     ],
     host_required: [
         "vm_shell",
diff --git a/microdroid_manager/aidl/android/system/virtualization/payload/IVmPayloadService.aidl b/microdroid_manager/aidl/android/system/virtualization/payload/IVmPayloadService.aidl
index 3859785..50d437f 100644
--- a/microdroid_manager/aidl/android/system/virtualization/payload/IVmPayloadService.aidl
+++ b/microdroid_manager/aidl/android/system/virtualization/payload/IVmPayloadService.aidl
@@ -67,4 +67,13 @@
      * @throws SecurityException if the use of test APIs is not permitted.
      */
     byte[] getDiceAttestationCdi();
+
+    /**
+     * Requests a certificate using the provided certificate signing request (CSR).
+     *
+     * TODO(b/271275206): Define the format of the CSR properly.
+     * @param csr the certificate signing request.
+     * @return the X.509 encoded certificate.
+     */
+    byte[] requestCertificate(in byte[] csr);
 }
diff --git a/microdroid_manager/src/vm_payload_service.rs b/microdroid_manager/src/vm_payload_service.rs
index 96f51f0..11e6967 100644
--- a/microdroid_manager/src/vm_payload_service.rs
+++ b/microdroid_manager/src/vm_payload_service.rs
@@ -67,6 +67,11 @@
         self.check_restricted_apis_allowed()?;
         Ok(self.dice.cdi_attest().to_vec())
     }
+
+    fn requestCertificate(&self, csr: &[u8]) -> binder::Result<Vec<u8>> {
+        self.check_restricted_apis_allowed()?;
+        self.virtual_machine_service.requestCertificate(csr)
+    }
 }
 
 impl Interface for VmPayloadService {}
diff --git a/service_vm/client_apk/Android.bp b/service_vm/client_apk/Android.bp
new file mode 100644
index 0000000..e5084d4
--- /dev/null
+++ b/service_vm/client_apk/Android.bp
@@ -0,0 +1,37 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_app {
+    name: "ServiceVmClientApp",
+    installable: true,
+    jni_libs: ["libservice_vm_client"],
+    jni_uses_platform_apis: true,
+    use_embedded_native_libs: true,
+    sdk_version: "system_current",
+    compile_multilib: "first",
+    apex_available: ["com.android.virt"],
+}
+
+rust_defaults {
+    name: "service_vm_client_defaults",
+    crate_name: "service_vm_client",
+    srcs: ["src/main.rs"],
+    prefer_rlib: true,
+    rustlibs: [
+        "libandroid_logger",
+        "libanyhow",
+        "liblog_rust",
+        "libvm_payload_bindgen",
+    ],
+}
+
+rust_ffi {
+    name: "libservice_vm_client",
+    defaults: ["service_vm_client_defaults"],
+    // TODO(b/250854486): Remove the sanitize section once the bug is fixed.
+    sanitize: {
+        address: false,
+        hwaddress: false,
+    },
+}
diff --git a/service_vm/client_apk/AndroidManifest.xml b/service_vm/client_apk/AndroidManifest.xml
new file mode 100644
index 0000000..b3598fc
--- /dev/null
+++ b/service_vm/client_apk/AndroidManifest.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2023 The Android Open Source Project
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+      package="com.android.virt.service_vm.client">
+     <uses-permission android:name="android.permission.MANAGE_VIRTUAL_MACHINE" />
+     <uses-permission android:name="android.permission.USE_CUSTOM_VIRTUAL_MACHINE" />
+
+     <application android:hasCode="false"/>
+</manifest>
diff --git a/service_vm/client_apk/assets/config.json b/service_vm/client_apk/assets/config.json
new file mode 100644
index 0000000..02749fe
--- /dev/null
+++ b/service_vm/client_apk/assets/config.json
@@ -0,0 +1,10 @@
+{
+    "os": {
+      "name": "microdroid"
+    },
+    "task": {
+      "type": "microdroid_launcher",
+      "command": "libservice_vm_client.so"
+    },
+    "export_tombstones": true
+  }
\ No newline at end of file
diff --git a/service_vm/client_apk/src/main.rs b/service_vm/client_apk/src/main.rs
new file mode 100644
index 0000000..1f8db96
--- /dev/null
+++ b/service_vm/client_apk/src/main.rs
@@ -0,0 +1,71 @@
+// Copyright 2023, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Main executable of Service VM client.
+
+use anyhow::Result;
+use log::{error, info};
+use std::{ffi::c_void, panic};
+use vm_payload_bindgen::AVmPayload_requestCertificate;
+
+/// Entry point of the Service VM client.
+#[allow(non_snake_case)]
+#[no_mangle]
+pub extern "C" fn AVmPayload_main() {
+    android_logger::init_once(
+        android_logger::Config::default()
+            .with_tag("service_vm_client")
+            .with_min_level(log::Level::Debug),
+    );
+    // Redirect panic messages to logcat.
+    panic::set_hook(Box::new(|panic_info| {
+        error!("{}", panic_info);
+    }));
+    if let Err(e) = try_main() {
+        error!("failed with {:?}", e);
+        std::process::exit(1);
+    }
+}
+
+fn try_main() -> Result<()> {
+    info!("Welcome to Service VM Client!");
+    let csr = b"Hello from Service VM";
+    let certificate = request_certificate(csr);
+    info!("Certificate: {:?}", certificate);
+    Ok(())
+}
+
+fn request_certificate(csr: &[u8]) -> Vec<u8> {
+    // SAFETY: It is safe as we only request the size of the certificate in this call.
+    let certificate_size = unsafe {
+        AVmPayload_requestCertificate(
+            csr.as_ptr() as *const c_void,
+            csr.len(),
+            [].as_mut_ptr() as *mut c_void,
+            0,
+        )
+    };
+    let mut certificate = vec![0u8; certificate_size];
+    // SAFETY: It is safe as we only write the data into the given buffer within the buffer
+    // size in this call.
+    unsafe {
+        AVmPayload_requestCertificate(
+            csr.as_ptr() as *const c_void,
+            csr.len(),
+            certificate.as_mut_ptr() as *mut c_void,
+            certificate.len(),
+        );
+    };
+    certificate
+}
diff --git a/virtualizationmanager/src/aidl.rs b/virtualizationmanager/src/aidl.rs
index 468ee19..f57cb59 100644
--- a/virtualizationmanager/src/aidl.rs
+++ b/virtualizationmanager/src/aidl.rs
@@ -1184,6 +1184,31 @@
             ))
         }
     }
+
+    fn requestCertificate(&self, csr: &[u8]) -> binder::Result<Vec<u8>> {
+        let cid = self.cid;
+        let Some(vm) = self.state.lock().unwrap().get_vm(cid) else {
+            error!("requestCertificate is called from an unknown CID {cid}");
+            return Err(Status::new_service_specific_error_str(
+                -1,
+                Some(format!("cannot find a VM with CID {}", cid)),
+            ))
+        };
+        let instance_img_path = vm.temporary_directory.join("rkpvm_instance.img");
+        let instance_img = OpenOptions::new()
+            .create(true)
+            .read(true)
+            .write(true)
+            .open(instance_img_path)
+            .map_err(|e| {
+                error!("Failed to create rkpvm_instance.img file: {:?}", e);
+                Status::new_service_specific_error_str(
+                    -1,
+                    Some(format!("Failed to create rkpvm_instance.img file: {:?}", e)),
+                )
+            })?;
+        GLOBAL_SERVICE.requestCertificate(csr, &ParcelFileDescriptor::new(instance_img))
+    }
 }
 
 impl VirtualMachineService {
diff --git a/virtualizationservice/Android.bp b/virtualizationservice/Android.bp
index f7202da..6b39ff9 100644
--- a/virtualizationservice/Android.bp
+++ b/virtualizationservice/Android.bp
@@ -28,6 +28,7 @@
         "libandroid_logger",
         "libanyhow",
         "libbinder_rs",
+        "libvmclient",
         "liblibc",
         "liblog_rust",
         "libnix",
diff --git a/virtualizationservice/aidl/android/system/virtualizationservice_internal/IVirtualizationServiceInternal.aidl b/virtualizationservice/aidl/android/system/virtualizationservice_internal/IVirtualizationServiceInternal.aidl
index 5422a48..cc59b3f 100644
--- a/virtualizationservice/aidl/android/system/virtualizationservice_internal/IVirtualizationServiceInternal.aidl
+++ b/virtualizationservice/aidl/android/system/virtualizationservice_internal/IVirtualizationServiceInternal.aidl
@@ -49,4 +49,14 @@
 
     /** Get a list of all currently running VMs. */
     VirtualMachineDebugInfo[] debugListVms();
+
+    /**
+     * Requests a certificate using the provided certificate signing request (CSR).
+     *
+     * @param csr the certificate signing request.
+     * @param instanceImgFd The file descriptor of the instance image. The file should be open for
+     *         both reading and writing.
+     * @return the X.509 encoded certificate.
+     */
+    byte[] requestCertificate(in byte[] csr, in ParcelFileDescriptor instanceImgFd);
 }
diff --git a/virtualizationservice/aidl/android/system/virtualmachineservice/IVirtualMachineService.aidl b/virtualizationservice/aidl/android/system/virtualmachineservice/IVirtualMachineService.aidl
index 3fdb48a..7b90714 100644
--- a/virtualizationservice/aidl/android/system/virtualmachineservice/IVirtualMachineService.aidl
+++ b/virtualizationservice/aidl/android/system/virtualmachineservice/IVirtualMachineService.aidl
@@ -44,4 +44,12 @@
      * Notifies that an error has occurred inside the VM.
      */
     void notifyError(ErrorCode errorCode, in String message);
+
+    /**
+     * Requests a certificate using the provided certificate signing request (CSR).
+     *
+     * @param csr the certificate signing request.
+     * @return the X.509 encoded certificate.
+     */
+    byte[] requestCertificate(in byte[] csr);
 }
diff --git a/virtualizationservice/src/aidl.rs b/virtualizationservice/src/aidl.rs
index 3888df2..5c5a7e4 100644
--- a/virtualizationservice/src/aidl.rs
+++ b/virtualizationservice/src/aidl.rs
@@ -16,8 +16,12 @@
 
 use crate::{get_calling_pid, get_calling_uid};
 use crate::atom::{forward_vm_booted_atom, forward_vm_creation_atom, forward_vm_exited_atom};
+use crate::rkpvm::request_certificate;
 use android_os_permissions_aidl::aidl::android::os::IPermissionController;
-use android_system_virtualizationservice::aidl::android::system::virtualizationservice::VirtualMachineDebugInfo::VirtualMachineDebugInfo;
+use android_system_virtualizationservice::{
+    aidl::android::system::virtualizationservice::VirtualMachineDebugInfo::VirtualMachineDebugInfo,
+    binder::ParcelFileDescriptor,
+};
 use android_system_virtualizationservice_internal::aidl::android::system::virtualizationservice_internal::{
     AtomVmBooted::AtomVmBooted,
     AtomVmCreationRequested::AtomVmCreationRequested,
@@ -153,6 +157,19 @@
             .collect();
         Ok(cids)
     }
+
+    fn requestCertificate(
+        &self,
+        csr: &[u8],
+        instance_img_fd: &ParcelFileDescriptor,
+    ) -> binder::Result<Vec<u8>> {
+        check_manage_access()?;
+        info!("Received csr. Getting certificate...");
+        request_certificate(csr, instance_img_fd).map_err(|e| {
+            error!("Failed to get certificate. Error: {e:?}");
+            Status::new_exception_str(ExceptionCode::SERVICE_SPECIFIC, Some(e.to_string()))
+        })
+    }
 }
 
 #[derive(Debug, Default)]
diff --git a/virtualizationservice/src/main.rs b/virtualizationservice/src/main.rs
index 64ccb13..bf8b944 100644
--- a/virtualizationservice/src/main.rs
+++ b/virtualizationservice/src/main.rs
@@ -16,6 +16,7 @@
 
 mod aidl;
 mod atom;
+mod rkpvm;
 
 use crate::aidl::{
     remove_temporary_dir, BINDER_SERVICE_IDENTIFIER, TEMPORARY_DIRECTORY,
diff --git a/virtualizationservice/src/rkpvm.rs b/virtualizationservice/src/rkpvm.rs
new file mode 100644
index 0000000..a4649f6
--- /dev/null
+++ b/virtualizationservice/src/rkpvm.rs
@@ -0,0 +1,95 @@
+// Copyright 2023, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Handles the RKP (Remote Key Provisioning) VM and host communication.
+//! The RKP VM will be recognized and attested by the RKP server periodically and
+//! serves as a trusted platform to attest a client VM.
+
+use android_system_virtualizationservice::{
+    aidl::android::system::virtualizationservice::{
+        CpuTopology::CpuTopology, DiskImage::DiskImage, Partition::Partition,
+        PartitionType::PartitionType, VirtualMachineConfig::VirtualMachineConfig,
+        VirtualMachineRawConfig::VirtualMachineRawConfig,
+    },
+    binder::{ParcelFileDescriptor, ProcessState},
+};
+use anyhow::{anyhow, Context, Result};
+use log::info;
+use std::fs::File;
+use std::time::Duration;
+use vmclient::VmInstance;
+
+const RIALTO_PATH: &str = "/apex/com.android.virt/etc/rialto.bin";
+
+pub(crate) fn request_certificate(
+    csr: &[u8],
+    instance_img_fd: &ParcelFileDescriptor,
+) -> Result<Vec<u8>> {
+    // We need to start the thread pool for Binder to work properly, especially link_to_death.
+    ProcessState::start_thread_pool();
+
+    let virtmgr = vmclient::VirtualizationService::new().context("Failed to spawn virtmgr")?;
+    let service = virtmgr.connect().context("virtmgr failed to connect")?;
+    info!("service_vm: Connected to VirtualizationService");
+    // TODO(b/272226230): Either turn rialto into the service VM or use an empty payload here.
+    // If using an empty payload, the service code will be part of pvmfw.
+    let rialto = File::open(RIALTO_PATH).context("Failed to open Rialto kernel binary")?;
+
+    // TODO(b/272226230): Initialize the partition from virtualization manager.
+    const INSTANCE_IMG_SIZE_BYTES: i64 = 1 << 20; // 1MB
+    service
+        .initializeWritablePartition(
+            instance_img_fd,
+            INSTANCE_IMG_SIZE_BYTES,
+            PartitionType::ANDROID_VM_INSTANCE,
+        )
+        .context("Failed to initialize instange.img")?;
+    let instance_img =
+        instance_img_fd.as_ref().try_clone().context("Failed to clone instance.img")?;
+    let instance_img = ParcelFileDescriptor::new(instance_img);
+    let writable_partitions = vec![Partition {
+        label: "vm-instance".to_owned(),
+        image: Some(instance_img),
+        writable: true,
+    }];
+    info!("service_vm: Finished initializing instance.img...");
+
+    let config = VirtualMachineConfig::RawConfig(VirtualMachineRawConfig {
+        name: String::from("Service VM"),
+        kernel: None,
+        initrd: None,
+        params: None,
+        bootloader: Some(ParcelFileDescriptor::new(rialto)),
+        disks: vec![DiskImage { image: None, partitions: writable_partitions, writable: true }],
+        protectedVm: true,
+        memoryMib: 300,
+        cpuTopology: CpuTopology::ONE_CPU,
+        platformVersion: "~1.0".to_string(),
+        taskProfiles: vec![],
+        gdbPort: 0, // No gdb
+    });
+    let vm = VmInstance::create(service.as_ref(), &config, None, None, None)
+        .context("Failed to create service VM")?;
+
+    info!("service_vm: Starting Service VM...");
+    vm.start().context("Failed to start service VM")?;
+
+    // TODO(b/274441673): The host can send the CSR to the RKP VM for attestation.
+    // Wait for VM to finish.
+    vm.wait_for_death_with_timeout(Duration::from_secs(10))
+        .ok_or_else(|| anyhow!("Timed out waiting for VM exit"))?;
+
+    info!("service_vm: Finished getting the certificate");
+    Ok([b"Return: ", csr].concat())
+}
diff --git a/vm_payload/Android.bp b/vm_payload/Android.bp
index 967d1cf..9d55879 100644
--- a/vm_payload/Android.bp
+++ b/vm_payload/Android.bp
@@ -36,7 +36,10 @@
     crate_name: "vm_payload_bindgen",
     source_stem: "bindings",
     apex_available: ["com.android.compos"],
-    visibility: ["//packages/modules/Virtualization/compos"],
+    visibility: [
+        "//packages/modules/Virtualization/compos",
+        "//packages/modules/Virtualization/service_vm/client_apk",
+    ],
     shared_libs: [
         "libvm_payload#current",
     ],
diff --git a/vm_payload/include-restricted/vm_payload_restricted.h b/vm_payload/include-restricted/vm_payload_restricted.h
index 7f17cde..1e0c3cc 100644
--- a/vm_payload/include-restricted/vm_payload_restricted.h
+++ b/vm_payload/include-restricted/vm_payload_restricted.h
@@ -22,6 +22,10 @@
 
 #include "vm_payload.h"
 
+#if !defined(__INTRODUCED_IN)
+#define __INTRODUCED_IN(__api_level) /* nothing */
+#endif
+
 // The functions declared here are restricted to VMs created with a config file;
 // they will fail if called in other VMs. The ability to create such VMs
 // requires the android.permission.USE_CUSTOM_VIRTUAL_MACHINE permission, and is
@@ -51,4 +55,18 @@
  */
 size_t AVmPayload_getDiceAttestationCdi(void* _Nullable data, size_t size);
 
+/**
+ * Requests a certificate using the provided certificate signing request (CSR).
+ *
+ * \param csr A pointer to the CSR buffer.
+ * \param csr_size The size of the CSR buffer.
+ * \param buffer A pointer to the certificate buffer.
+ * \param size number of bytes that can be written to the certificate buffer.
+ *
+ * \return the total size of the certificate
+ */
+size_t AVmPayload_requestCertificate(const void* _Nonnull csr, size_t csr_size,
+                                     void* _Nullable buffer, size_t size)
+        __INTRODUCED_IN(__ANDROID_API_V__);
+
 __END_DECLS
diff --git a/vm_payload/libvm_payload.map.txt b/vm_payload/libvm_payload.map.txt
index a2402d1..f0d867e 100644
--- a/vm_payload/libvm_payload.map.txt
+++ b/vm_payload/libvm_payload.map.txt
@@ -7,6 +7,7 @@
     AVmPayload_getDiceAttestationCdi;    # systemapi
     AVmPayload_getApkContentsPath;       # systemapi
     AVmPayload_getEncryptedStoragePath;  # systemapi
+    AVmPayload_requestCertificate;       # systemapi introduced=35
   local:
     *;
 };
diff --git a/vm_payload/src/api.rs b/vm_payload/src/api.rs
index 4b565e0..6ca473a 100644
--- a/vm_payload/src/api.rs
+++ b/vm_payload/src/api.rs
@@ -256,6 +256,52 @@
     get_vm_payload_service()?.getDiceAttestationCdi().context("Cannot get attestation CDI")
 }
 
+/// Requests a certificate using the provided certificate signing request (CSR).
+/// Panics on failure.
+///
+/// # Safety
+///
+/// Behavior is undefined if any of the following conditions are violated:
+///
+/// * `csr` must be [valid] for reads of `csr_size` bytes.
+/// * `buffer` must be [valid] for writes of `size` bytes. `buffer` can be null if `size` is 0.
+///
+/// [valid]: ptr#safety
+#[no_mangle]
+pub unsafe extern "C" fn AVmPayload_requestCertificate(
+    csr: *const u8,
+    csr_size: usize,
+    buffer: *mut u8,
+    size: usize,
+) -> usize {
+    initialize_logging();
+
+    // SAFETY: See the requirements on `csr` above.
+    let csr = unsafe { std::slice::from_raw_parts(csr, csr_size) };
+    let certificate = unwrap_or_abort(try_request_certificate(csr));
+
+    if size != 0 || buffer.is_null() {
+        // SAFETY: See the requirements on `buffer` above. The number of bytes copied doesn't exceed
+        // the length of either buffer, and `certificate` cannot overlap `buffer` because we just
+        // allocated it.
+        unsafe {
+            ptr::copy_nonoverlapping(
+                certificate.as_ptr(),
+                buffer,
+                std::cmp::min(certificate.len(), size),
+            );
+        }
+    }
+    certificate.len()
+}
+
+fn try_request_certificate(csr: &[u8]) -> Result<Vec<u8>> {
+    let certificate = get_vm_payload_service()?
+        .requestCertificate(csr)
+        .context("Failed to request certificate")?;
+    Ok(certificate)
+}
+
 /// Gets the path to the APK contents.
 #[no_mangle]
 pub extern "C" fn AVmPayload_getApkContentsPath() -> *const c_char {
diff --git a/vm_payload/src/lib.rs b/vm_payload/src/lib.rs
index 5c3ee31..4d059d1 100644
--- a/vm_payload/src/lib.rs
+++ b/vm_payload/src/lib.rs
@@ -17,6 +17,7 @@
 mod api;
 
 pub use api::{
-    AVmPayload_getDiceAttestationCdi, AVmPayload_getDiceAttestationChain,
-    AVmPayload_getVmInstanceSecret, AVmPayload_notifyPayloadReady,
+    AVmPayload_getCertificate, AVmPayload_getDiceAttestationCdi,
+    AVmPayload_getDiceAttestationChain, AVmPayload_getVmInstanceSecret,
+    AVmPayload_notifyPayloadReady,
 };