tpm2_certifyX509certutil(1)

📦
version 5.8 · 10 versions
, in arch rolling

💖 NAME 💖

okay so this is tpm2_certifyX509certutil(1) — the manual page for the tool that does Generate partial X509 certificate. It’s giving “tiny cert builder with main character energy,” and we’re obsessed. 🎀

✨ SYNOPSIS ✨

tpm2_certifyX509certutil [OPTIONS]

that’s the whole vibe, bestie: tool name plus options. 💅

🌸 DESCRIPTION 🌸

tpm2_certifyX509certutil(1) generates a partial certificate that is suitable as the third input parameter for the TPM2_certifyX509 command. The certificate data is written into a file in DER format and can be examined using the openssl asn1parse tool as follows:

openssl asn1parse -in partial_cert.der -inform DER

like, it makes the partial cert, drops it in DER, and lets you peek at it with openssl. slay. 🦋

🦋 OPTIONS 🦋

These are the available options:

  • -o, --outcert=STRING — The output file where the certificate will be written to. The default is partial_cert.der. Optional parameter. 💖
  • -d, --days=NUMBER — The number of days the certificate will be valid starting from today. The default is 3560 (10 years). Optional parameter. ⭐
  • -i, --issuer=STRING — The ISSUER entry for the cert in the following format: –issuer=“C=US;O=org;OU=Org unit;CN=cname”. Supported fields are:
    • C — “Country”, max size = 2
    • O — “Org”, max size = 8
    • OU — “Org Unit”, max size = 8
    • CN — “Common Name”, max size = 8 The files need to be separated with semicolon. At list one supported field is required for the option to be valid. Optional parameter. 🌸
  • -s, --subject=STRING — The SUBJECT for the cert in the following format: –subject=“C=US;O=org;OU=Org unit;CN=cname”. Supported fields are:
    • C — “Country”, max size = 2
    • O — “Org”, max size = 8
    • OU — “Org Unit”, max size = 8
    • CN — “Common Name”, max size = 8 The files need to be separated with semicolon. At list one supported field is required for the option to be valid. Optional parameter. 🎀
  • ARGUMENT — No arguments required. ✨

📚 References 📚

The original has this heading and then… nothing listed under it. Empty-section realness, preserved with love. 🫶

🌈 COMMON OPTIONS 🌈

This collection of options are common to many programs and provide information that many users may expect — yes bestie, group-chat-common options, the ones lots of tools share. 💜

  • -h, --help=[man|no-man] — Display the tools manpage. By default, it attempts to invoke the manpager for the tool, however, on failure will output a short tool summary. This is the same behavior if the man option argument is specified, however if explicit man is requested, the tool will provide errors from man on stderr. If the no-man option if specified, or the manpager fails, the short options will be output to stdout. To successfully use the manpages feature requires the manpages to be installed or on MANPATH, See man(1) for more details. 🧚
  • -v, --version — Display version information for this tool, supported tctis and exit. 💅
  • -V, --verbose — Increase the information that the tool prints to the console during its execution. When using this option the file and line number are printed. 🔥
  • -Q, --quiet — Silence normal tool output to stdout. 🤫
  • -Z, --enable-errata — Enable the application of errata fixups. Useful if an errata fixup needs to be applied to commands sent to the TPM. Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent. ⭐
  • -z, --pwd-session — Use password session instead of a HMAC session for authentication. A clear text password is passed to the TPM to authorize the action. This option can be used to avoid problems when unsalted sessions are used in OpenSSL FIPS mode. If auth values are used a salted session should be used for authentication. 🔐
  • -R, --autoflush — Enable autoflush for transient objects created by the command. If a parent object is loaded from a context file also the transient parent object will be flushed. Autoflush can also be activated if the environment variable TPM2TOOLS_AUTOFLUSH is is set to yes or true. (Yes, the original literally has “is is” — we keep the lore.) information many users may expect. 💀
Also, the original bullet trails off with “information many users may expect.” — no cap, we’re preserving that little stray phrase too. 🫶

🔥 EXAMPLES 🔥

tpm2 certifyX509certutil -o partial_cert.der -d 356

Yep, this example spells it tpm2 certifyX509certutil exactly like the original — we don’t fix, we preserve. 💖

💀 Returns 💀

Tools can return any of the following codes:

  • 0 — Success. 👑
  • 1 — General non-specific error. 😭
  • 2 — Options handling error. 🙈
  • 3 — Authentication error. 🔐
  • 4 — TCTI related error. 💅
  • 5 — Non supported scheme. Applicable to tpm2_testparams. 💀

🐛 BUGS 🐛

Github Issues

🫶 HELP 🫶

See the Mailing List

👑 License 👑

This work is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

Source/version vibes: tpm2-tools · page: tpm2_certifyX509certutil(1) · date: the original footer has no date, so we’re not inventing one, bestie. Signed off with sparkle and zero cap. 💖✨

📦 where this page comes from