tpmtool(1)

📦
version 3.8.13 · 8 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, nixpkgs unstable, ubuntu stonking

💖 tpmtool(1) — the GnuTLS TPM tool 💖

okay bestie, sit down, hydrate, because we're talking about tpmtool, a User Command from the GnuTLS fam. yes it's a whole tool for the Trusted Platform Module chip in your machine. yes it's giving hardware cryptography main character energy. let's go 🧚

✨ NAME ✨

tpmtool — GnuTLS TPM tool 🎀

✨ SYNOPSIS ✨

tpmtool [-flags] [-flag [value]] [--option-name[[=| ]value]]

All arguments must be options. like, every single one. there are no loose positional stragglers here, she doesn't do that. periodt 💅

✨ DESCRIPTION ✨

It's a program that lets you handle cryptographic data from the TPM chip. that's the whole vibe. TPM stuff, handled. 🔥

✨ OPTIONS ✨

  • -d num, --debug=num — turns on debugging. takes an integer as its argument, and that integer is constrained: it has to be in the range 0 through 9999. this is the debug level, so bigger number = more yapping. 🫶
  • --infile=file — the input file. that's it, that's the whole thing.
  • --outfile=str — the output file. where the goodies land. 💾
  • --generate-rsa — generates an RSA private-public key pair. and like, specifically: it makes the pair in the TPM chip. the key can be stored in the file system and protected by a PIN, or stored (registered) in the TPM chip flash. two paths, both iconic. 👑
  • --register — any generated key will be registered in the TPM. ⚠️ this one is clingy: it must appear in combination with generate-rsa.
  • --signing — any generated key will be a signing key. ✍️ and the rules, bestie: it must not appear in combination with legacy, and it must appear in combination with generate-rsa.
  • --legacy — any generated key will be a legacy key. the same energy but backwards: it must not appear in combination with signing, and it must appear in combination with generate-rsa.
  • --user — any registered key will be a user key. it must not appear in combination with system, and it must appear in combination with register. the generated key will be stored in a user specific persistent storage. 🙋♀️
  • --system — any registered key will be a system key. it must not appear in combination with user, and it must appear in combination with register. the generated key will be stored in system persistent storage. 🏛️
  • --pubkey=url — prints the public key of the provided key. 🗝️
  • --list — lists all stored keys in the TPM. the receipts, basically. 📋
  • --delete=url — deletes the key identified by the given URL (UUID). bye babe 💀
  • --test-sign=url — tests the signature operation of the provided object. it can be used to test the correct operation of the signature operation. this operation will sign and verify the signed data. it's a little self-check, a wellness check for your signing. 🩺
  • --sec-param=security parameter — specify the security level [low, legacy, medium, high, ultra]. this is an alternative to the bits option. note however that the values allowed by the TPM chip are quantized and given values may be rounded up. so don't come for the TPM when it rounds, she's doing her best. ✨
  • --bits=num — specify the number of bits for key generate. takes an integer as its argument. 🔢
  • --inder, --no-inder — use the DER format for keys. the no-inder form will disable the option. the input files will be assumed to be in the portable DER format of TPM. and heads up: the default format is a custom format used by various TPM tools.
  • --outder, --no-outder — use DER format for output keys. the no-outder form will disable the option. the output will be in the TPM portable DER format. 📦
  • --srk-well-known — SRK has well known password (20 bytes of zeros). twenty zeros. just so you know. 🫥
  • -v arg, --version=arg — output version of program and exit. the default mode is v, a simple version. the c mode will print copyright information and the n mode will print the full copyright notice. ✨
  • -h, --help — display usage information and exit. the classic. 🫶
  • -!, --more-help — pass the extended usage information through a pager. fancy girl behavior, scrolling and everything. 💅

✨ EXAMPLES ✨

to generate a key that is to be stored in file system use:

$ tpmtool --generate-rsa --bits 2048 --outfile tpmkey.pem

to generate a key that is to be stored in TPM's flash use:

$ tpmtool --generate-rsa --bits 2048 --register --user

to get the public key of a TPM key use:

$ tpmtool --pubkey tpmkey:uuid=58ad734b-bde6-45c7-89d8-756a55ad1891;storage=user           --outfile pubkey.pem

or if the key is stored in the file system:

$ tpmtool --pubkey tpmkey:file=tmpkey.pem --outfile pubkey.pem

to list all keys stored in TPM use:

$ tpmtool --list

✨ EXIT STATUS ✨

one of the following exit values will be returned:

  1. 0 (EXIT_SUCCESS) — successful program execution. slay. 🎉
  2. 1 (EXIT_FAILURE) — the operation failed or the command syntax was not valid. 😭

✨ SEE ALSO ✨

p11tool (1), certtool (1) — the rest of the GnuTLS girlies. go say hi 🦋

✨ AUTHORS ✨

ngl bestie, this section is literally empty in the original. no names, no nothing. the void. the silence. mysterious queen behavior 🙈

Copyright (C) 2020-2023 Free Software Foundation, and others all rights reserved. this program is released under the terms of the GNU General Public License, version 3 or later. 💜

✨ BUGS ✨

found a bug? don't be shy, don't suffer in silence. please send bug reports to: bugs@gnutls.org 📬

and that's the whole page, bestie. this was tpmtool from the GnuTLS crew, version 3.8.13, dated 29 Apr 2026. iykyk. go forth and talk to your TPM chip responsibly 🎀✨💖

📦 where this page comes from