swtpm-create-tpmca(8)

📦
version 0.10.2 · 15 versions
, in opensuse-leap 16.0

💅 swtpm-create-tpmca(8) — like, the whole manual, bestie

okay so this is the manual page for swtpm-create-tpmca, part of the swtpm crew. Sit down, grab a boba, we're gonna get you a TPM CA. 🧚✨

🌸 NAME 🌸

swtpm-create-tpmca — the tool that makes a local CA for swtpm_localca. literally its whole personality. 💅

✨ SYNOPSIS ✨

swtpm-create-tpmca [OPTIONS]

that's it. that's the whole vibe. options go in, CA comes out. 🎀

🦋 DESCRIPTION 🦋

So swtpm-create-tpmca is the tool that creates a TPM 1.2 or TPM 2 based CA, and that CA is what swtpm_localca uses to sign EK and platform certificates. Slay. 👑

The CA signs certificates using a GnuTLS key. And here's the tea on how that goes down:

  • if it's a TPM 1.2, GnuTLS talks to the TPM 1.2 through the tcsd (TrouSerS) daemon. old school, still iconic.
  • if it's a TPM 2, you also need the Intel pkcs11 driver and its tools (tpm2_ptool). no driver, no vibes.

And because a TPM CA's certificate has to be signed by a CA, a root certificate authority gets created too, and it signs this certificate. The root CA's private key and certificate live in the same directory as the signing key, with the names:

  • swtpm-localca-rootca-privkey.pem
  • swtpm-localca-rootca-cert.pem

respectively, obviously. 💖 And you can set the environment variable SWTPM_ROOTCA_PASSWORD for the password of the root CA's private key. yes bestie, environment variable, not a flag. iykyk.

Note: this tool is experimental. see the known issues section below, it's giving ⚠️.

The following options are supported:

🎀 OPTIONS 🎀

  • --dir dir — the directory where the keys get written to. if there's already a root CA chilling in this directory with the files swtpm-localca-rootca-privkey.pem and swtpm-localca-rootca-cert.pem, it gets reused, periodt. but if either one of those files doesn't exist, a brand new root CA gets created. 💫
  • --overwrite — overwrites the contents of the output directory. no cap, it just wipes and goes.
  • --register — registers the key with TCSD. heads up though: for the key to actually be available for signing, the same user that created the TPM CA has to run the swtpm_localca tool later on. if you don't pass this option, the private key is written into a file and can be used by others as well. so like, your call. 🙈
  • --key-password s — the new signing key gets this password. simple as that.
Note: due to a bug in GnuTLS certtool it may be necessary to use the same password for the signing key as for the SRK. not me debugging this at 2am 💀
  • --srk-password s — the TPM SRK password.
Note: since GnuTLS tpmtool does not support the 'well known' password of 20 zero bytes, the SRK password must be set. no skipping this one.
  • --outfile filename — the name of a file where the swtpm-localca.conf configuration gets written to.
  • --owner owner — the name or uid number of the owner who will own the directory and the outfile file. ⚠️ this option only has an effect if this swtpm-create-tpmca is run by the root user.
  • --group group — the name or gid number of the group who will own the directory and the outfile file. also only has an effect if this swtpm-create-tpmca is run by the root user. root-only behavior, iconic honestly.
  • --tss-tcsd-hostname — the hostname where tcsd is running on. the default hostname is 'localhost'. 🏠
  • -tss-tcsd-port — the TCP port on which tcsd is listening for messages. the default port is 30003. (yes, single dash, that's how it's written, don't come for me 🫶)
  • --tpm2 — the TPM used for signing the certificates is a TPM 2, and Intel's TSS stack must be running (tpm2-abrmd) along with its PKCS11 module. the TPM 2 PKCS11 module must have been initialized using the tpm2_ptool. 🔥

The environment variables SWTPM_PKCS11_PIN and SWTPM_PKCS11_SO_PIN should be set to hold the PINs. If SWTPM_PKCS11_PIN is not set then the default PIN 'swtpm-tpmca' will be used. SWTPM_PKCS11_SO_PIN is needed for creating the token and must be explicitly set as an environment variable. don't forget it bestie 💀

  • --pid pimary-object-id — the primary object id that the tpm2_ptool returns upon 'init'.
  • -help, -h, -? — display the help screen and exit. the classic. 💅

🌈 EXAMPLE 🌈

The following example creates an intermediate TPM CA, writes the keys into /var/lib/swtpm-localca, and writes the swtpm_localca configuration to /etc/swtpm-localca.conf. After that it can be used for signing certificates of newly created swtpm TPMs. main character energy fr fr. ✨

If the host's TPM is a TPM 1.2, we need to start the tcsd first and can then create the TPM key and TPM CA certificate:

#> sudo systemctl start tcsd
#> sudo /usr/share/swtpm/swtpm-create-tpmca \
               --dir /var/lib/swtpm-localca \
               --overwrite \
               --outfile /etc/swtpm-localca.conf \
               --srk-password password \
               --key-password password \
               --group tss
statedir = /var/lib/swtpm-localca
signingkey = tpmkey:file=/var/lib/swtpm-localca/swtpm-localca-tpmca-privkey.pem
issuercert = /var/lib/swtpm-localca/swtpm-localca-tpmca-cert.pem
certserial = /var/lib/swtpm-localca/certserial
TSS_TCSD_HOSTNAME = localhost
TSS_TCSD_PORT = 30003
signingkey_password = password
parentkey_password = password

Alternatively, if the host's TPM is a TPM 2 and Intel's TPM 2 stack is installed, we need to start tpm2-abrmd first and can then create the TPM key and TPM CA certificate:

#> sudo systemctl start tpm2-abrmd     # may not be required with recent Intel TPM 2 tools
#> sudo tpm2_ptool init
action: Created
id: 1                   # this is the --pid parameter below
#> sudo SWTPM_PKCS11_PIN="mypin 123" SWTPM_PKCS11_SO_PIN=123 /usr/share/swtpm/swtpm-create-tpmca \
               --dir /var/lib/swtpm-localca \
               --overwrite \
               --outfile /etc/swtpm-localca.conf \
               --group tss \
               --tpm2 \
               --pid 1
statedir = /var/lib/swtpm-localca
signingkey = pkcs11:model=SW%20%20%20TPM\;manufacturer=IBM\;serial=0000000000000000\;token=swtpm-tpmca-1\;id=%31\;object=swtpm-tpmca-key\;type=private
issuercert = /var/lib/swtpm-localca/swtpm-localca-tpmca-cert.pem
certserial = /var/lib/swtpm-localca/certserial
SWTPM_PKCS11_PIN = mypin 123
Note: this also works for non-root users by adapting the --dir and --outfile parameters here and below by changing the --dir parameter and adding a --config parameter. 🫶

To test either one of the above TPM CAs, run the following command:

#> swtpm_localca \
       --type ek --ek x=11,y=13 \
       --dir /tmp --vmid test --tpm2 \
       --tpm-spec-family 2.0 --tpm-spec-revision 146 --tpm-spec-level 00 \
       --tpm-model swtpm --tpm-version 20170101 --tpm-manufacturer IBM

The --tpm2 in this command indicates that the TPM for which the certificate is created is a TPM 2. (different --tpm2, same word, keep up 💅)

💀 KNOWN ISSUES 💀

okay so this part is a little cursed, ngl. 😭

The interaction of GnuTLS certtool with the TPM TCSD daemon may cause so many TPM (key) authentication failures that the TPM refuses to accept any more authenticated commands — until the TPM's owner sends it the TPM_ORD_ResetLockValue command. not a drill.

Why does this happen? Because certtool first tries to use 20 zero bytes for the SRK password, and only then prompts for and uses the required SRK password. Meanwhile the GnuTLS tpmtool does not support 20 zero bytes for the SRK password, so it forces the usage of a 'real' password. mismatch behavior, honestly a mess. 🙈

The effect of those authentication failures may be that the TPM CA cannot sign certificates, since the TPM does not accept authenticated commands. so like... yeah. ⚠️

👑 SEE ALSO 👑

swtpm_localca, swtpm-localca.conf, tcsd

🐛 REPORTING BUGS 🐛

Report bugs to Stefan Berger <stefanb@linux.ibm.com> 💌

and that's the whole page bestie, go forth and create CAs 🦋✨

swtpm · 2026-08-23 · swtpm-create-tpmca(8) — mwah, tysm for reading, ily 🫶💖🎀

📦 where this page comes from