Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device certificates. One of our products has a TPM available on which I could create a 2K RSA keypair. My question here is, if I can sign the public key of the keypair that was generated inside the TPM.
In my opinion this should work as following:
- generate the keypair on the TPM
- export the public key of the keypair out of the TPM
- generate a CSR that includes the public key generated by the TPM
- have the CSR signed by my CA and store the certificate on the device (doesn't need to be on the TPM)
My crypto library must now be setup accordingly to use the TPM whenever private-key operations are required.