swtpm-localca.conf(8)

💖 swtpm-localca.conf(8) — bestie, let's talk config files 💖

okay so this is the manual page for swtpm-localca.conf from the swtpm manual, section 8. yes, it's a configuration file manpage, and yes, it's lowkey the most useful little gremlin in your CA setup. let's go 🫶

---

✨ NAME ✨

swtpm-localca.conf — the configuration file for swtpm_localca 💅

---

🌸 DESCRIPTION 🌸

so the file /etc/swtpm-localca.conf is where you keep the configuration variables for the swtpm_localca program. that's it, that's the whole vibe. it's giving "settings drawer" energy 🎀

Entries may contain environment variables that will be resolved. and bestie, there's a format, okay, they can't just be any old thing — all environment variables must be formatted like this: ${varname}. no cap.

Users may write their own configuration into ${XDG_CONFIG_HOME}/swtpm-localca.conf or, if XDG_CONFIG_HOME is not set, it may be in ${HOME}/.config/swtpm-localca.conf. choose your own adventure, queen 👑

The following configuration variables are supported:

• statedir — the name of a directory where to store data into. a lock will be created in this directory. (yes, a lock, it's protecting its stuff, iconic behavior 🔒)
• signinkey — the file containing the key used for signing the certificates. provide a key in PEM format or a pkcs11 URI. ✍️
• signingkey_password — the password to use for the signing key. 🤫
• issuercert — the file containing the certificate for this CA. provide a certificate in PEM format. 📜
• certserial — the name of file containing the serial number for the next certificate. 🔢
• TSS_TCSD_HOSTNAME — this variable can be set to the host where tcsd is running on in case the signing key is a GnuTLS TPM 1.2 key. by default localhost will be used. 🏠
• TSS_TCSD_PORT — this variable can be set to the port on which tcsd is listening for connections. by default port 30003 will be used. 🔌
• env:<environment variable name=<value>> — environment variables that are needed by pkcs11 modules can be set using this format. an example for such an environment variable may look like this:

env:MY_MODULE_PKCS11_CONFIG = /tmp/mymodule-pkcs11.conf

⚠️ bestie listen — the line must not contain any trailing spaces. not even one. the way this will absolutely ruin your day if you don't check. i'm serious 😭

---

🌈 EXAMPLE 🌈

an example swtpm-localca.conf file may look as follows:

 statedir = /var/lib/swtpm_localca
 signingkey = /var/lib/swtpm_localca/signkey.pem
 issuercert = /var/lib/swtpm_localca/issuercert.pem
 certserial = /var/lib/swtpm_localca/certserial

With a PKCS11 URI it may look like this:

 statedir = /var/lib/swtpm-localca
 signingkey = pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=891b99c169e41301;token=mylabel;id=%00;object=mykey;type=public
 issuercert = /var/lib/swtpm-localca/swtpm-localca-tpmca-cert.pem
 certserial = /var/lib/swtpm-localca/certserial
 SWTPM_PKCS11_PIN = 1234

look at that second one. it's giving "i know what i'm doing" main character energy fr fr 🔥

---

🦋 SEE ALSO 🦋

• swtpm_localca

---

💌 REPORTING BUGS 💌

Report bugs to Stefan Berger <stefanb@linux.vnet.ibm.com>. he's the one who knows 👑

---

and that's the whole page, bestie!! this was swtpm and the page was dated 2024-11-08. now go forth and configure your local CA, you absolute legend 💖✨🎀