swtpm_setup.conf(5)

💖 NAME 💖

okay so bestie, <pink>swtpm_setup.conf</pink> is literally the configuration file for swtpm_setup — that's the whole vibe. 🎀

---

✨ DESCRIPTION ✨

The file /etc/swtpm_setup.conf holds all the config info for swtpm_setup. Rules of the house, no cap:

• one configuration keyword per line, fr fr — no doubling up
• then an equals sign =
• then the appropriate configuration information
• a comment at the end of the line is allowed, and you kick it off with a hash # sign

And here's the cute part — users can write their own config into ${XDG_CONFIG_HOME}/swtpm_setup.conf, or if XDG_CONFIG_HOME isn't set, it can live in ${HOME}/.config/swtpm_setup.conf. your own personal era 💅

The following keywords are recognized 👑:

🌸 create_certs_tool

bestie this one gets followed by the name of an executable or executable script used for creating various TPM certificates. The tool will be called with the following options:

• --type type — this parameter indicates the type of certificate to create. The type parameter may be one of the following: ek, or platform
• --dir dir — this parameter indicates the directory into which the certificate is to be stored. It is expected that the EK certificate is stored in this directory under the name ek.cert and the platform certificate under the name platform.cert
• --ek ek — this parameter indicates the modulus of the public key of the endorsement key (EK). The public key is provided as a sequence of ASCII hex digits
• --vmid ID — this parameter indicates the ID of the VM for which to create the certificate
• --logfile <logfile> — the log file to log output to; by default logging goes to stdout and stderr on the console
• --configfile <configuration file> — the configuration file to use. This file typically contains configuration information for the invoked program. If omitted, the program must use its default configuration file
• --optsfile <options file> — the options file to use. This file typically contains options that the invoked program uses. If omitted, the program must use its default options file
• --tpm-spec-family <family>, --tpm-spec-level <level>, --tpm-spec-revision <revision> — these 3 options describe the TPM specification that was followed for the implementation of the TPM and will be part of the EK certificate 🌈
• --tpm2 — this option is passed in case a TPM 2 compliant certificate needs to be created

🦋 create_certs_tool_config

this keyword is to be followed by the name of a configuration file that will be passed to the invoked program using the --configfile option described above. If omitted, the invoked program will use the default configuration file ✨

🎀 create_certs_tool_options

this keyword is to be followed by the name of an options file that will be passed to the invoked program using the --optsfile option described above. If omitted, the invoked program will use the default options file ✨

💜 active_pcr_banks (since v0.7)

this keyword is to be followed by a comma-separated list of names of PCR banks. The list must not contain any spaces. Valid PCR bank names are sha1, sha256, sha384, and sha512. no spaces, i'm serious, the parser is not playing 🙈

🔥 rsa_keysize (since v0.10)

this keyword allows you to specify the default RSA keysize to be used if it is not provided with a command line option to swtpm_setup. Any value that can be passed to swtpm_setup is also valid here, such as 2048, or 'max'. The supported key sizes depend on the version of libtpms — so like, vibe check your libtpms first 👀

⭐ profile (since v0.10)

this keyword allows you to specify either the name of a profile or a JSON map describing the profile, such as:

profile = {"Name": "default-v1"}

Please also refer to the description of the --profile option for swtpm_setup. iykyk 💅

🌈 profile_file (since v0.10)

this keyword allows you to specify a default profile file.

🧚 local_profiles_dir (since v0.10)

this keyword allows you to set a profile directory that contains profiles written by users of the system. your profiles, your rules 💖

---

👀 SEE ALSO 👀

swtpm_setup

---

🫶 REPORTING BUGS 🫶

Report bugs to Stefan Berger <stefanb@linux.vnet.ibm.com> — he's the main character of this bug tracker ngl 💀

---

okay that's the whole page bestie, you ate 🍓 this was swtpm (yes, that's the source/version tag, cute right) dated 2026-08-23, and the manual is swtpm_setup.conf(5). mwah 💋 periodt ✨