swtpm-localca.conf(5)

💅 swtpm-localca.conf — like, the manual page, bestie

okay so this is the page for swtpm-localca.conf in section 5 of the manual, and honestly? it's a cute little config file page and you're gonna get it in like two minutes. stay with me 🫶

---

✨ NAME ✨

swtpm-localca.conf — the configuration file for swtpm_localca. that's it, that's the whole name section, we love a short intro 💖

---

🌸 DESCRIPTION 🌸

The file /etc/swtpm-localca.conf contains configuration variables for the swtpm_localca program. so like, that's the main-character file — everything else is a spinoff 😌

Entries may contain environment variables that will be resolved. All environment variables must be formatted like this: ${varname} — literally that exact shape, don't freestyle it 💅

Users may write their own configuration into ${XDG_CONFIG_HOME}/swtpm-localca.conf or, if XDG_CONFIG_HOME is not set, it may be in ${HOME}/.config/swtpm-localca.conf. your own little corner of config, we stan ✨

The following configuration variables are supported:

• statedir — the name of a directory where to store data into. A lock will be created in this directory. it's giving "my stuff lives here" 🎀
• signinkey — the file containing the key used for signing the certificates. Provide a key in PEM format or a pkcs11 URI. yes bestie, either one, both are iconic 🔑
• signingkey_password — the password to use for the signing key. keep it secret, keep it safe 🙈
• issuercert — the file containing the certificate for this CA. Provide a certificate in PEM format. the origin story certificate, fr fr 👑
• certserial — the name of file containing the serial number for the next certificate.

The serial number must be a decimal number and must be representable with 20 bytes or less. Once 21 bytes are used a new random serial number with 20 decimal digits will be created. so like, 20 bytes max — after that the system just goes "new number, who dis" and rolls you a fresh random one with 20 decimal digits 💀

• TSS_TCSD_HOSTNAME — this variable can be set to the host where tcsd is running on in case the signing key is a GnuTLS TPM 1.2 key. By default localhost will be used. default is home base 🏠
• TSS_TCSD_PORT — this variable can be set to the port on which tcsd is listening for connections. By default port 30003 will be used. write that number down, 30003, no cap 🌀
• env:<environment variable name=<value>> — environment variables, that are needed by pkcs11 modules, can be set using this format. An example for such an environment variable may look like this:

env:MY_MODULE_PKCS11_CONFIG = /tmp/mymodule-pkcs11.conf

⚠️ The line must not contain any trailing spaces. like literally none. the trailing space will ruin your whole life and the config parser will NOT be nice about it 😭

---

🦋 EXAMPLE 🦋

An example swtpm-localca.conf file may look as follows:

 statedir = /var/lib/swtpm_localca
 signingkey = /var/lib/swtpm_localca/signkey.pem
 issuercert = /var/lib/swtpm_localca/issuercert.pem
 certserial = /var/lib/swtpm_localca/certserial

With a PKCS11 URI it may look like this:

 statedir = /var/lib/swtpm-localca
 signingkey = pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=891b99c169e41301;token=mylabel;id=%00;object=mykey;type=public
 issuercert = /var/lib/swtpm-localca/swtpm-localca-tpmca-cert.pem
 certserial = /var/lib/swtpm-localca/certserial
 SWTPM_PKCS11_PIN = 1234

copy the vibes, not my typos — actually no, copy the exact strings, this is config, precision is the aesthetic ⭐

---

🧚 SEE ALSO 🧚

• swtpm_localca

go read that one next, it's the whole reason this config file exists, iykyk 💜

---

🍓 REPORTING BUGS 🍓

Report bugs to Stefan Berger <stefanb@linux.vnet.ibm.com> — be nice, be specific, include the details, that's the vibe check 🌈

---

and that's the whole page, bestie!! written for swtpm, dated 2026-08-23, in good old section 5 of the manual — swtpm-localca.conf(5), slay, periodt 💅✨🎀