man/man8/swtpm-localca.pod

   1 =head1 NAME
   2
   3 swtpm-localca  - Local CA to create EK and platform certs for swtpm
   4
   5 =head1 SYNOPSIS
   6
   7 B<swtpm-localca [OPTIONS]>
   8
   9 =head1 DESCRIPTION
  10
  11 B<swtpm-localca> is a tool to create TPM Endorsement Key (EK) and platform
  12 certificates on the host. It uses the I<swtpm_cert> program to create
  13 the certificates.
  14
  15 The program will typically be invoked by the I<swtpm_setup> program
  16 that uses the I</etc/swtpm_setup.conf> configuration file where
  17 a variable needs to be set that points to this program.
  18 It implements command line options that the I<swtpm_setup>
  19 program uses to provide the necessary parameters to it.
  20
  21 B<swtpm-localca> will automatically try to create the signing key and
  22 certificate if the configuration points to a missing signing key.
  23 Since this certificate must be signed by a CA, a root certificate authority
  24 will also be created and will sign this certificate. The root CA's
  25 private key and certificate will be located in the same directory as the
  26 signing key and have the names swtpm-localca-rootca-privkey.pem and
  27 swtpm-localca-rootca-cert.pem respectively. The environment variable
  28 SWTPM_ROOTCA_PASSWORD can be set for the password of the root CA's
  29 private key.
  30
  31 The following options are supported:
  32
  33 =over 4
  34
  35 =item B<--type type>
  36
  37 This parameter indicates the type of certificate to create. The type parameter may
  38 be one of the following: I<ek>, or I<platform>
  39
  40 =item B<--dir dir>
  41
  42 This parameter indicates the directory into which the certificate is to be stored.
  43 The EK certificate is stored in this directory under the name
  44 ek.cert and the platform certificate under the name platform.cert.
  45
  46 =item B<--ek ek>
  47
  48 This parameter indicates the modulus of the public key of the endorsement key
  49 (EK). The public key is provided as a sequence of ASCII hex digits.
  50
  51 In case ECC (elliptic curve crypography) keys are used, the parameter must
  52 have the format --ek x=<hex digits>,y=<hex digits>.
  53
  54 =item B<--vmid ID>
  55
  56 This parameter indicates the ID of the VM for which to create the certificate.
  57
  58 =item B<--logfile <logfile>>
  59
  60 The log file to log output to; by default logging goes to stdout and stderr
  61 on the console.
  62
  63 =item B<--configfile <configuration file>>
  64
  65 The configuration file to use. If omitted, the default configuration
  66 file I</etc/swtpm-localca.conf> will be used.
  67
  68 =item B<--optsfile <options file>>
  69
  70 The options file to use. If omitted, the default options file
  71 I</etc/swtpm-localca.options> will be used.
  72
  73 =item B<--tpm-spec-family>, B<--tpm-spec-revision>, B<--tpm-spec-level>
  74
  75 TPM specification parameters that describe the specification that was
  76 followed for the TPM implementation. The parameters will be passed
  77 to swtpm_cert for the creation of the EK certificate.
  78
  79 =item B<--tpm2>
  80
  81 Create TPM 2 compliant certificates.
  82
  83 =item B<--allow-signing>
  84
  85 Create an EK that can also be used for signing. Without this option, the
  86 EK can only be used for key encipherment. This option requires --tpm2.
  87
  88 =item B<--decryption>
  89
  90 If --allow-signing is passed and the EK should also be useable for key
  91 encipherment, this option must be passed. Otherwise key encipherment is the
  92 default. This option requires --tpm2.
  93
  94 =back
  95
  96 =head1 SEE ALSO
  97
  98 B<swtpm-localca.conf>, B<swtpm-localca.options>,
  99 B<swtpm_setup>, B<swtpm_setup.conf>
 100
 101 =head1 REPORTING BUGS
 102
 103 Report bugs to Stefan Berger <stefanb@linux.vnet.ibm.com>