I have my TPM2.0 connected to my raspberry pi. I generated a Cert file and Private key using openssl. These files are used to connect MQTT with TLS. How do I store/secure these files in/with the TPM on a raspberry pi. Once stored/secured how do I use them again? Say in a command like this:

    curl -v \
      -X POST https://<The-domain> \
      --cert ./encrytped-cert.pem \
      --key ./encrypted-key.pem \
      -d temperature=50

The end goal is to use these files in an MQTT python script. For now doing it in command line would work.

1 Answer 1


I don't know which underlying implementation the Python MQTT libs uses, but some MQTT libraries can use a PKCS#11 token to handle crypto operations.

You now need something exposing the TPM chip as PKCS#11 token, e.g. https://github.com/tpm2-software/tpm2-pkcs.

BTW don't import keys on the TPM if you can generate keys on chip.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .