Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device certificates. One of our products has a TPM available on which I could create a 2K RSA keypair. My question here is, if I can sign the public key of the keypair that was generated inside the TPM.

In my opinion this should work as following:

  • generate the keypair on the TPM
  • export the public key of the keypair out of the TPM
  • generate a CSR that includes the public key generated by the TPM
  • have the CSR signed by my CA and store the certificate on the device (doesn't need to be on the TPM)

My crypto library must now be setup accordingly to use the TPM whenever private-key operations are required.

  • And where is the question? – Crypt32 Jul 20 '18 at 14:56
  • This should be possible. Which technology stack are you using for this and which OS? – Frank Jul 24 '18 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.