tpmtool(1) User Commands tpmtool(1)

# [NAME](#NAME)

**tpmtool** - GnuTLS TPM tool

# [SYNOPSIS](#SYNOPSIS)

**tpmtool** \[**-flags**] \[**-flag** \[*value*]] \[**--option-name**\[\[=| ]*value*]]

All arguments must be options.

# [DESCRIPTION](#DESCRIPTION)

Program that allows handling cryptographic data from the TPM chip.

# [OPTIONS](#OPTIONS)

[**-d** *num*, **--debug**=*num*](#d)

Enable debugging. This option takes an integer number as its argument. The value of *num* is constrained to being:

```
in the range 0 through 9999
```

Specifies the debug level.

[**--infile**=*file*](#infile)

Input file.

[**--outfile**=*str*](#outfile)

Output file.

[**--generate-rsa**](#generate)

Generate an RSA private-public key pair.

Generates an RSA private-public key pair in the TPM chip. The key may be stored in file system and protected by a PIN, or stored (registered) in the TPM chip flash.

[**--register**](#register)

Any generated key will be registered in the TPM. This option must appear in combination with the following options: generate-rsa.

[**--signing**](#signing)

Any generated key will be a signing key. This option must not appear in combination with any of the following options: legacy. This option must appear in combination with the following options: generate-rsa.

[**--legacy**](#legacy)

Any generated key will be a legacy key. This option must not appear in combination with any of the following options: signing. This option must appear in combination with the following options: generate-rsa.

[**--user**](#user)

Any registered key will be a user key. This option must not appear in combination with any of the following options: system. This option must appear in combination with the following options: register.

The generated key will be stored in a user specific persistent storage.

[**--system**](#system)

Any registered key will be a system key. This option must not appear in combination with any of the following options: user. This option must appear in combination with the following options: register.

The generated key will be stored in system persistent storage.

[**--pubkey**=*url*](#pubkey)

Prints the public key of the provided key.

[**--list**](#list)

Lists all stored keys in the TPM.

[**--delete**=*url*](#delete)

Delete the key identified by the given URL (UUID).

[**--test-sign**=*url*](#test)

Tests the signature operation of the provided object.

It can be used to test the correct operation of the signature operation. This operation will sign and verify the signed data.

[**--sec-param**=*security parameter*](#sec)

Specify the security level \[low, legacy, medium, high, ultra].

This is alternative to the bits option. Note however that the values allowed by the TPM chip are quantized and given values may be rounded up.

[**--bits**=*num*](#bits)

Specify the number of bits for key generate. This option takes an integer number as its argument.

[**--inder**, **--no-inder**](#inder)

Use the DER format for keys. The *no-inder* form will disable the option.

The input files will be assumed to be in the portable DER format of TPM. The default format is a custom format used by various TPM tools

[**--outder**, **--no-outder**](#outder)

Use DER format for output keys. The *no-outder* form will disable the option.

The output will be in the TPM portable DER format.

[**--srk-well-known**](#srk)

SRK has well known password (20 bytes of zeros).

[**-v** *arg*, **--version**=*arg*](#v)

Output version of program and exit. The default mode is \`v', a simple version. The \`c' mode will print copyright information and \`n' will print the full copyright notice.

[**-h**, **--help**](#h)

Display usage information and exit.

**-!**, **--more-help**

Pass the extended usage information through a pager.

# [EXAMPLES](#EXAMPLES)

To generate a key that is to be stored in file system use:

```
$ tpmtool --generate-rsa --bits 2048 --outfile tpmkey.pem


```

To generate a key that is to be stored in TPM's flash use:

```
$ tpmtool --generate-rsa --bits 2048 --register --user


```

To get the public key of a TPM key use:

```
$ tpmtool --pubkey tpmkey:uuid=58ad734b-bde6-45c7-89d8-756a55ad1891;storage=user           --outfile pubkey.pem


```

or if the key is stored in the file system:

```
$ tpmtool --pubkey tpmkey:file=tmpkey.pem --outfile pubkey.pem


```

To list all keys stored in TPM use:

```
$ tpmtool --list


```

# [EXIT STATUS](#EXIT_STATUS)

One of the following exit values will be returned:

0 (EXIT\_SUCCESS)

Successful program execution.

1 (EXIT\_FAILURE)

The operation failed or the command syntax was not valid.

# [SEE ALSO](#SEE_ALSO)

[p11tool (1)](/man/os/gnutls/p11tool.1), [certtool (1)](/man/os/gnutls/certtool.1)

# [AUTHORS](#AUTHORS)

# [COPYRIGHT](#COPYRIGHT)

Copyright (C) 2020-2023 Free Software Foundation, and others all rights reserved. This program is released under the terms of the GNU General Public License, version 3 or later

# [BUGS](#BUGS)

Please send bug reports to: bugs@gnutls.org

09 May 2026 3.8.13

---

Document: tpmtool(1) from gnutls 3.8.13-r1 (Chainguard OS)
Source: https://gitlab.com/gnutls/gnutls