If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for instance ? What is the purpose of "-keyform engine" ? Do you know any documentation that better eplain the use of "-engine tpm2tss -keyform engine" than the official one on https://github.com/tpm2-software/tpm2-tss-engine ?

Example 1: Generating a CSR

 openssl req -new -engine tpm2tss -keyform engine -key 0x81800003 -out csr1

Example 2: Getting a certificate from a PKI using CMP for OpenSSL

openssl cmp -cmd ir -server pki_server:8040 \
-path signing-cmp/test -cert /tmp/mycert.crt \
-key 0x81800001 -newkey 0x81800002 \
-subject '/C=FR/CN=domain.com/ST=London/L=London/O=Organization/OU=IT Administration' \
-certout /tmp/new.crt -srvcert /tmp/srvcert.crt


1 Answer 1


I am not sure to fully understand the question, but I recently encountered a similar situation.

I did not found evidence that it is possible to use TPM persistent handle in OpenSSL command in place of file path for keys. OpenSSL is not made to fully interact with the TPM, it can only use the tpm2 cryptographic calculations through the engine.

To know if an engine can work with some OpenSSL extensions like CMP, you can run openssl engine -t -c tpm2tss, it will return something similar if the engine is able to communicate with the TPM:

(tpm2tss) TPM2-TSS engine for OpenSSL
    [RSA, RAND]
        [ available ]

RSA and RAND are for example the OpenSSL commands supported by my OpenSSL TPM2 engine.

And for the purpose of -keyform engine, it indicates OpenSSL to use the key format proposed by the engine. In the case of the TPM2 engine, the keyform is a custom TSS format, a PEM-like format with the TSS key encoded inside, and when I looked up in the code, the struct of for example the TSS private key appeared to be:

typedef struct {
    ASN1_OBJECT *type;
    ASN1_BOOLEAN emptyAuth;
    ASN1_INTEGER *parent;
    ASN1_OCTET_STRING *pubkey;
    ASN1_OCTET_STRING *privkey;

Source (Github)

It stores additional TPM related information in this custom format.

To finish with, I did not find lot of information about the use of the TPM2TSS engine to share, this is mainly what I ended up with through my experimentations.

  • Hi thanks for this answer. Do you know when to use "-inform engine" instead of "-keyform engine" ? For example : "openssl ec -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub" (source: github.com/tpm2-software/tpm2-tss-engine/blob/master/README.md) Jan 29, 2020 at 10:17
  • 1
    Once you have generated a key with '-outform engine', since the key is in the custom engine format, if you want to use it, for example with 'openssl rsa -in tsskey ...', you need to precise that the key format come from the engine. With '-inform engine' openssl will use the custom tss format to read the key. You need to precise it everytime you want to use the tss generated key.
    – Hexalden
    Jan 29, 2020 at 10:33
  • 1
    @Quadrique Hello and welcome to Stack Exchange. That's a fantastic answer! I edited the answer a little to improve the formatting, I hope you agree with the change. If not, you can roll back to your previous version.
    – user163495
    Jan 29, 2020 at 10:38
  • @MechMK1 thank you for the editing !:)
    – Hexalden
    Jan 29, 2020 at 10:55
  • 1
    @Quadrique You're welcome. If you want to format a multi-line text as code (or just monospaced), you can prefix every line with 4 spaces. That way you avoid the white lines in between.
    – user163495
    Jan 29, 2020 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .