/usr/bin/swtpm_setup

TPM emulator setup tool version 0.10.2
Usage: /usr/bin/swtpm_setup [options]

The following options are supported:

--runas <user>   : Run this program under the given user's account.

--tpm-state <dir>: Path where the TPM's state will be written to;
                   this is a mandatory argument. Prefix with dir:// to
                   use directory backend, or file:// to use linear file.

--tpmstate <dir> : This is an alias for --tpm-state <dir>.

--tpm <executable>
                 : Path to the TPM executable; this is an optional argument and
                   by default 'swtpm' in the PATH is used.

--swtpm_ioctl <executable>
                 : Path to the swtpm_ioctl executable; this is deprecated
                   argument.

--tpm2           : Setup a TPM 2; by default a TPM 1.2 is setup.

--createek       : Create the EK; for a TPM 2 an RSA and ECC EK will be
                   created

--allow-signing  : Create an EK that can be used for signing;
                   this option requires --tpm2.
                   Note: Careful, this option will create a non-standard EK!

--decryption     : Create an EK that can be used for key encipherment;
                   this is the default unless --allow-signing is given;
                   this option requires --tpm2.

--ecc            : This option allows to create a TPM 2's ECC key as storage
                   primary key; a TPM 2 always gets an RSA and an ECC EK key.

--take-ownership : Take ownership; this option implies --createek
  --ownerpass  <password>
                 : Provide custom owner password; default is ooo
  --owner-well-known:
                 : Use an owner password of 20 zero bytes
  --srkpass <password>
                 : Provide custom SRK password; default is sss
  --srk-well-known:
                 : Use an SRK password of 20 zero bytes
--create-ek-cert : Create an EK certificate; this implies --createek

--create-platform-cert
                 : Create a platform certificate; this implies --create-ek-cert

--create-spk     : Create storage primary key; this requires --tpm2; deprecated

--lock-nvram     : Lock NVRAM access

--display        : At the end display as much info as possible about the
                   configuration of the TPM

--config <config file>
                 : Path to configuration file; default is /etc/swtpm_setup.conf

--logfile <logfile>
                 : Path to log file; default is logging to stderr

--keyfile <keyfile>
                 : Path to a key file containing the encryption key for the
                   TPM to encrypt its persistent state with. The content
                   must be a 32 hex digit number representing a 128bit AES key.
                   This parameter will be passed to the TPM using
                   '--key file=<file>'.

--keyfile-fd <fd>: Like --keyfile but a file descriptor is given to read the
                   encryption key from.

--pwdfile <pwdfile>
                 : Path to a file containing a passphrase from which the
                   TPM will derive the 128bit AES key. The passphrase can be
                   32 bytes long.
                   This parameter will be passed to the TPM using
                   '--key pwdfile=<file>'.

--pwdfile-fd <fd>: Like --pwdfile but a file descriptor is given to to read
                   the passphrase from.

--cipher <cipher>: The cipher to use; either aes-128-cbc or aes-256-cbc;
                   the default is aes-128-cbc; the same cipher must be
                   used on the swtpm command line

--overwrite      : Overwrite existing TPM state by re-initializing it; if this
                   option is not given, this program will return an error if
                   existing state is detected

--not-overwrite  : Do not overwrite existing TPM state but silently end

--vmid <vm id>   : Unique (VM) identifier to use as common name in certificate

--pcr-banks <banks>
                 : Set of PCR banks to activate. Provide a comma separated list
                   like 'sha1,sha256'. '-' to skip and leave all banks active.
                   Default: sha256

--rsa-keysize <keysize>
                 : The RSA key size of the EK key; 3072 bits may be supported
                   if libtpms supports it.
                   Default: 2048

--write-ek-cert-files <directory>
                 : Write EK cert files into the given directory

--tcsd-system-ps-file <file>
                 : This option is deprecated and has no effect.

--print-capabilities
                 : Print JSON formatted capabilities added after v0.1 and exit.

--create-config-files [[overwrite][,root]]
                 : Create swtpm_setup and swtpm-localca config files for a
                   user account.
                   overwrite: overwrite any existing files
                   root: allow to create files under root's home directory
                   skip-if-exist: if any file exists exit without error

--reconfigure    : Reconfigure an existing swtpm by reusing existing state.
                   The active PCR banks can be changed but no new keys will
                   be created.

--profile <json-profile>
                 : Configure swtpm with the given profile.

--profile-name <profile name | built-in profile name>
                 : Search for a profile with the <name>.json in distro and
                   local directories; if not found try it as a built-in.

--profile-file <file>
                 : Configure swtpm with a profile read from the given file.

--profile-file-fd <fd>
                 : Configure swtpm with a profile read from a file descriptor.

--profile-remove-disabled check|fips-host
                 : Instruct swtpm to remove algorithms that may be disabled by
                   FIPS mode on the host from 'custom' profile.
                   check: algorithms are tested.
                   fips-host: no testing.

--print-profiles : Display all local and distro-provided profile as well as
                   the ones built into libtpms and exit.

--version        : Display version and exit

--help,-h        : Display this help screen