swtpm_localca(8)

🌸 swtpm_localca — bestie edition 🎀

okay so real talk: swtpm_localca lives in section 8 of the manual (the sysadmin-y one), and it's the local CA girlie who makes EK and platform certs for swtpm. she's giving ✨ certificate authority ✨ and honestly she ate.

✨ NAME ✨

swtpm_localca — the Local CA that creates EK and platform certs for swtpm 👑

🦋 SYNOPSIS 🦋

swtpm_localca [OPTIONS]

💖 DESCRIPTION 💖

swtpm_localca is a tool that creates TPM Endorsement Key (EK) and platform certificates on the host. she doesn't do it alone bestie — she uses the swtpm_cert program to actually create the certificates. teamwork makes the dream work fr fr 💅

the program will typically be invoked by the swtpm_setup program, which reads the /etc/swtpm_setup.conf configuration file — and in there a variable needs to be set that points to this program. she implements the command line options that swtpm_setup uses to hand her all the necessary parameters. iykyk 🫶

swtpm_localca will automatically try to create the signing key and certificate if the configuration points to a missing signing key. and because this certificate has to be signed by a CA, a root certificate authority also gets created — and it signs this certificate. the root CA's private key and certificate live in the same directory as the signing key, and their names are swtpm-localca-rootca-privkey.pem and swtpm-localca-rootca-cert.pem respectively. also!! the environment variable SWTPM_ROOTCA_PASSWORD can be set for the password of the root CA's private key. 🔑

note, and this one's important bestie: due to limitations of certtool, the possible passwords used for securing the root CA's private key and the intermediate CA's private key have to be passed over the command line — which means they will be visible to others on the system 😭💀 if you're concerned about this, you should create the CAs elsewhere and copy them onto the target system. no cap, that's the move.

the following options are supported:

🌈 OPTIONS 🌈

• --type type — this parameter tells her the type of certificate to create. type can be one of the following: ek, or platform. pick your fighter 💅
• --dir dir — this parameter is the directory the certificate gets stored into. the EK certificate goes in this directory under the name ek.cert, and the platform certificate under the name platform.cert. cute and organized 🎀
• --ek ek or --key key — this parameter is the modulus of the public key of the endorsement key (EK), provided as a sequence of ASCII hex digits.
  • the --key option is an alias for --ek and should be used if key parameters for another key than an endorsement key are passed.
  • in case ECC (elliptic curve cryptography) keys are used, the parameter must have the format --ek x=<hex digits>,y=<hex digits>,id=<curve id>. the id=<curve id> part is optional and only necessary for ECC curves other than secp256r1. 🌀
• --vmid ID — this parameter is the ID of the VM for which to create the certificate.
• --logfile <logfile> — the log file to log output to; by default logging goes to stdout and stderr on the console. (default is main character energy on your terminal, basically ✨)
• --configfile <configuration file> — the configuration file to use. if omitted, the default configuration file /etc/swtpm-localca.conf will be used.
• --optsfile <options file> — the options file to use. if omitted, the default options file /etc/swtpm-localca.options will be used.
• --tpm-spec-family, --tpm-spec-revision, --tpm-spec-level — TPM specification parameters that describe the specification that was followed for the TPM implementation. these parameters get passed to swtpm_cert for the creation of the EK certificate. 📋
• --tpm2 — create TPM 2 compliant certificates. slay 💅
• --allow-signing — create an EK that can also be used for signing. without this option, the EK can only be used for key encipherment. ⚠️ this option requires --tpm2.
• --decryption — if --allow-signing is passed and the EK should also be usable for key encipherment, this option must be passed. otherwise key encipherment is the default. ⚠️ this option requires --tpm2. (yes she's a little stacked, keep up 🫶)

---

👀 SEE ALSO 👀

swtpm-localca.conf, swtpm-localca.options, swtpm_setup, swtpm_setup.conf

💀 REPORTING BUGS 💀

report bugs to Stefan Berger <stefanb@linux.vnet.ibm.com> — he's the one to @ fr fr 🙈

---

that's the whole vibe bestie, go make some certs 💜✨

this page is from swtpm and it's dated 2026-08-23 — that's the manual swtpm_localca(8), and honestly? iconic. 🎀🦋