TSSCERTIFYX509(1)

🌸 NAME 🌸

tsscertifyx509 — runs tsscertifyx509. That's the name, bestie. This is the TSSCERTIFYX509(1) manual page from the User Commands section. Periodt. 💅

✨ DESCRIPTION ✨

Okay so tsscertifyx509 runs TPM2_Certifyx509. That's the whole vibe. No cap, we're about to list every single option, value, default, and example — no skips, we ate. 🍓

• -ho — object handle. The main character handle. No brackets, so you know it's up front.
• -pwdo — optional. Password for object (default empty). iykyk.
• -hk — certifying key handle. Another required vibe.
• -pwdk — optional. Password for key (default empty).
• -halg — optional. Hash algorithm: sha256 or sha384 (default sha256). Slay.
• -rsa keybits — RSA key bits. Valid values are:
  • 2048
  • 3072
• -ecc curve — ECC curve. Valid values are:
  • nistp256
  • nistp384
• -ku — optional. X509 key usage string, comma separated, no spaces. Keep it tight.
• -iob — optional. TPMA_OBJECT as 4-byte hex. Examples, bestie:
  • e.g. sign: critical,digitalSignature,keyCertSign,cRLSign (default)
  • e.g. decrypt: critical,dataEncipherment,keyAgreement,encipherOnly,decipherOnly
  • e.g. fixedTPM: critical,nonRepudiation
  • e.g. parent (restrict decrypt): critical,keyEncipherment
• -bit — optional. Bit in partialCertificate to toggle.
• -sub — optional. Subject same as issuer for self-signed (root) certificate.
• -opc — optional. Partial certificate file name (default do not save).
• -oa — optional. addedToCertificate file name (default do not save).
• -otbs — optional. signed tbsDigest file name (default do not save).
• -os — optional. Signature file name (default do not save).
• -ocert — optional. Reconstructed certificate file name (default do not save).
• -se[0-2] — session handle / attributes (default PWAP). Values:
  • 01 — continue
  • 20 — command decrypt
  • 40 — response encrypt

💖 That's a wrap, bestie! This was tsscertifyx509 version 1.6, dated November 2020, from the TSSCERTIFYX509(1) manual. Stay iconic, slay the TPM2_Certifyx509 game. 💖