SYSTEMD-TPM2-SETUP.SERVICE(8)

💖 systemd-tpm2-setup.service(8) — the manual page, but make it make sense 💖

okay bestie, gather round, because this is systemd-tpm2-setup.service(8) and she is lowkey the reason your TPM2 keys exist at all. no cap.

---

✨ NAME ✨

systemd-tpm2-setup.service, systemd-tpm2-setup-early.service, systemd-tpm2-setup — Set up the TPM2 Storage Root Key (SRK), Endorsement Key (EK), and initialize NvPCRs at boot

---

🎀 SYNOPSIS 🎀

systemd-tpm2-setup.service

/usr/lib/systemd/systemd-tpm2-setup

---

🦋 DESCRIPTION 🦋

so here's the tea. systemd-tpm2-setup.service</p> and systemd-tpm2-setup-early.service</p> are services that generate the Storage Root Key (SRK) and Endorsement Key (EK) if they have not been generated yet, and stores them in the TPM. and if NvPCRs (additional PCR registers in TPM NV Indexes) are defined, these are initialized with the anchoring secret. she's doing the most, and honestly? iconic. 👑

the services will store the public key of the SRK key pair in a PEM file in /run/systemd/tpm2-srk-public-key.pem and /var/lib/systemd/tpm2-srk-public-key.pem. they will also store it in TPM2B_PUBLIC format in /run/systemd/tpm2-srk-public-key.tpm2_public and /var/lib/systemd/tpm2-srk-public-key.tpm2b_public. two formats, two homes, main character energy fr fr. ✨

systemd-tpm2-setup-early.service runs very early at boot (possibly in the initrd), and writes the SRK public key to /run/systemd/tpm2-srk-public-key.* (as /var/ is generally not accessible this early yet), while systemd-tpm2-setup.service runs during a later boot phase and saves the public key to /var/lib/systemd/tpm2-srk-public-key.*.

so like: early girl drops the key in /run/, later girl moves it home to /var/. the way that /var/ just isn't there at 3am boot time 😭 it's giving "we'll deal with it when the filesystem shows up".

---

🌸 FILES 🌸

• /run/systemd/tpm2-srk-public-key.pem, /run/systemd/tpm2-srk-public-key.tpm2b_public — The SRK public key in PEM and TPM2B_PUBLIC format, written during early boot.

Added in version 255.

• /var/lib/systemd/tpm2-srk-public-key.pem, /var/lib/systemd/tpm2-srk-public-key.tpm2_public — The SRK public key in PEM and TPM2B_PUBLIC format, written during later boot (once /var/ is available).

Added in version 255.

• /usr/lib/nvpcr/*.nvpcr — Definition files for NvPCRs.

Added in version 259.

🙈 friendly reminder that the filenames above are exactly what the page says — /run/... has the tpm2b_public one and /var/lib/... has the tpm2_public one. don't come for me, come for the source. iykyk 💅

---

🫶 SEE ALSO 🫶

systemd(1)

---

and that's the whole vibe check, bestie 💖 this page lives in systemd 262.1 and it's the SYSTEMD-TP...UP.SERVICE(8) manual — go forth and slay your boot sequence. periodt. 🌈⭐🎀