TSSCREATEEKCERT(1)

🌸 NAME 🌸

tsscreateekcert — runs tsscreateekcert. That's what the page says, bestie, and we're not gonna pretend otherwise. It's a User Command in section 1, so go off 💅

---

✨ SYNOPSIS ✨

tsscreateekcert -rsa 2048     -cakey cakey.pem    -capwd rrrr -v
tsscreateekcert -ecc nistp256 -cakeyecc.pem -capwd rrrr -caalg ec
-v

Copy those character for character, ok? No editing, no "fixing", no nothing. 🫶

---

💖 DESCRIPTION 💖

createekcert — it provisions an EK certificate using the default IWG template. That's the whole vibe. E.g.,

Then there's the flag lineup. Notice how every single one is wrapped in [ ] except -cakey… so yeah, that one is not optional, no cap. 🙈

• -pwdp platform — the platform hierarchy password. Default is empty.
• -pwde endorsement — the endorsement hierarchy password. Default is empty.
• -pwdk password for endorsement key — default is empty.
• -cakey CA PEM key file name — the CA PEM key file name. Give it what it wants.
• -capwd — CA PEM key password. Default is empty.
• -caalg — the CA key algorithm, either rsa or ecc. Default is rsa.
• -high — use the NV high range. Specify it before the algorithm, bestie, that part matters.
• -rsa keybits — your keybits options are 2048 and 3072.
• -ecc curve — your curve options are nistp256, nistp384 and nistp521.
• -noflush — do not flush the primary key. It's giving "leave it alone".
• -of — DER certificate output file name.

Currently: Certificate issuer, subject, and validity are hard coded. So don't go looking for flags to change those — they're baked in, periodt.

---

tsscreateekcert 1.6, from November 2020 — that's the source, the version, and the date, all in one lil sign-off. Slay, bye bestie 💜🦋