/usr/bin/swtpm_cert

TPM certificate tool version 0.10.2, Copyright (c) 2015 IBM Corp.

Usage: /usr/bin/swtpm_cert [options]

Create TPM certificates without requiring the EK private key.

The following options are supported:
--pubkey <filename>       : PEM file for public key (EK)
--signkey <filename>      : PEM file for CA signing key or GnuTLS TPM or
                            PKCS11 URL
--signkey-password <pass> : Password for the CA signing key
--signkey-pwd <pwd>       : Alternative password option for CA signing key
--parentkey-password <p>  : Password of parent key; SRK password of TPM
--parentkey-pwd <pwd>     : Alternative password option for SRK password
--issuercert <filename>   : PEM file with CA cert
--out-cert <filename>     : Filename for certificate
--modulus <hex string>    : The modulus of the public key
--exponent <exponent>     : The exponent of the public key
--ecc-x                   : ECC key x component
--ecc-y                   : ECC key y component
--ecc-curveid <id>        : ECC curve id; secp256r1, secp384r1, secp521r1
                            default: secp256r1
--serial <serial number>  : The certificate serial number
--days <number>           : Number of days the cert is valid;
                            -1 for no expiration
--pem                     : Write certificate in PEM format; default is DER
--type <platform|ek>      : The type of certificate to create; default is ek
--tpm-manufacturer <name> : The name of the TPM manufacturer
--tpm-model <model>       : The TPM model (part number)
--tpm-version <version>   : The TPM version (firmware version)
--platform-manufacturer <name> : The name of the Platform manufacturer
--platform-model <model>       : The Platform model (part number)
--platform-version <version>   : The Platform version (firmware version)
--tpm-spec-family <family>     : Specification family (string)
--tpm-spec-level <level>       : Specification level (integer)
--tpm-spec-revision <rev>      : Specification revision (integer)
--subject <subject>       : Subject such as location in format
                            C=US,ST=NY,L=NewYork; not used with TPM1.2
--add-header              : Add the TCG certificate header describing
                            a TCG_PCCLIENT_STORED_CERT for TPM1.2 NVRAM
--tpm2                    : Issue a TPM 2 compliant certificate
--allow-signing           : The EK of a TPM 2 allows signing;
                            requires --tpm2
--decryption              : The EK if a TPM 2 can be used for key
                            encipherment; requires --tpm2
--print-capabilities      : Print capabilities and exit
--version                 : Display version and exit
--help                    : Display this help screen and exit

The following environment variables are supported:

SWTPM_PKCS11_PIN              : PKCS11 PIN to use

Password passed in 'pwd' options support the following formats:
- <password>           : direct password
- pass:<password>      : direct password
- fd:<file descriptor> : read password from file descriptor
- file:<filename>      : read password from filename
- env:<env. varname>   : read from environment variable