swtpm_cert(8)

💅 swtpm_cert — okay so this is the swtpm_cert(8) page, welcome

Bestie. Sit down. We're gonna talk about swtpm_cert, the tool that makes EK and platform certs for swtpm (both the 1.2 and the 2.0 girlies). 🎀

---

✨ NAME ✨

swtpm_cert — the tool that creates EK and platform certs for swtpm (1.2 & 2.0), no cap 💅

---

🌸 SYNOPSIS 🌸

swtpm_cert [OPTIONS]

---

🦋 DESCRIPTION 🦋

So swtpm_cert is a local CA tool that creates X.509v3 certificates for the TPM's Endorsement Key. And the whole reason this specific tool exists is genuinely iconic: it works without access to the Endorsement Key's private key. Like, normally tools want either a self-signed certificate request or straight-up access to the private key to issue a cert. This one? It works with only the public key part. Periodt. 👑

The following options are supported:

---

💖 OPTIONS 💖

• --type {ek|platform} — the type of certificate you're creating; if you don't say anything, an EK certificate gets created by default ✨
• --pubkey <filename> — the public key (EK) in PEM format 🔑
• --modulus <hex digits> — the modulus of the public key, as a string of hex digits. You can pass this instead of the --pubkey option, iykyk.
• --ecc-x <hex digits> — the elliptic curve parameter x, as a string of hex digits.
• --ecc-y <hex digits> — the elliptic curve parameter y, as a string of hex digits.
• --ecc-curveid <curve id> — the elliptic curve's id. secp256r1, secp384r1, and secp521r1 are supported. If you don't give this option, secp256r1 is assumed 🌈
• --exponent <exponent> — the exponent of the public key. By default 0x10001 is assumed.
• --signkey <filename> — the key used for signing the certificate. Heads up: the file must be in PEM format 🔥
• --signkey-password <password> — optional password for the signing key.
• --signkey-pwd <pwd> — alternative option for passing the signing key password. The following formats are supported for pwd:
  • <password> — direct password
  • pass:<password> — direct password
  • file:<filename> — password in file
  • fd:<file descriptor> — read password from file descriptor
  • env:<environment variable> — read password from env. variable

All passwords read from files and file descriptors must be a maximum of 255 bytes (plus one byte for terminating NUL byte). Not me warning you about the byte limit 💀

• --parentkey-password <password> — optional password for a parent key. In case a TPM key is used for signing, this would be the password for the TPM's storage root key (SRK).
• --parentkey-pwd <pwd> — alternative option for passing the parentkey password. See the description above for supported pwd formats 🫶
• --issuercert <filename> — the X.509 certificate of this signer that takes on the role of a local CA 👑
• --out-cert <filename> — the name of the file to write the X.509v3 certificate into. The output will be in PEM format.
• --serial <serial number> — optional 32bit serial number for the certificate.
• --days <number> — the number of days the certificate is valid; by default it is valid for 365 days 📅
• --pem — write the resulting certificate in PEM format; DER format is the default.
• --tpm-manufacturer <name> — the name of the TPM manufacturer.
• --tpm-model <model> — the TPM model (part number).
• --tpm-version <version> — the TPM's firmware version.
• --platform-manufacturer <name> — the name of the platform manufacturer.
• --platform-model <model> — the platform model.
• --platform-version <version> — the platform's version.
• --subject <subject> — subject, to for example provide the location of the TPM in the format C=<country>,ST=<state>,L=<location>. Note that the location must no contain any spaces ⚠️ (yes, that says "no", quoting the original, she's quirky like that).
• --tpm2 — issue TPM 2 compliant certificates 💫
• --allow-signing — create an EK that can also be used for signing. Without this option, the EK can only be used for key encipherment. This option requires --tpm2.
• --decryption — if --allow-signing is passed and the EK should also be usable for key encipherment, this option must be passed. Otherwise key encipherment is the default. This option requires --tpm2.
• --print-capabilities (since v0.3) — print capabilities that were added to swtpm_cert after version 0.2. The output may contain the following:

{
  "type": "swtpm_cert",
  "features": [
    "cmdarg-signkey-pwd",
    "cmdarg-parentkey-pwd"
  ],
  "version": "0.7.0"
}

The version field is available since 0.7. ⭐

The meaning of the feature verbs is as follows:

• cmdarg-signkey-pwd — the --signkey-pwd option is supported.
• cmdarg-parentkey-pwd — the --parentkey-pwd option is supported.

• --help, -h — display the help screen 🫶

---

🎀 SEE ALSO 🎀

Literally nothing here yet bestie — the section exists, the vibes are empty. 🙈

---

💀 REPORTING BUGS 💀

Report bugs to Stefan Berger <stefanb@linux.vnet.ibm.com> — he's the main character of this bug tracker, respect it.

---

ngl if something's cooked, email the address above instead of yelling into the void. 💜

---

✨ that's the whole page, bestie ✨ this is from the swtpm source, dated 2026-08-23 — swtpm_cert(8), and you ate that, no crumbs 🍓🧚💅