samples: Extend script to create a CA using a TPM 2 for signing

Extend the script that creates a CA that uses a TPM 2 for signing.
For this we have to create tokens using the TPM 2 pkcs11 module's
tpm2_ptool and can then use the p11tool for creating keys.

Add a test case that requires a running tpm2-abrmd and tpm2_ptool.
Eventually the test case should (try to) start its own tpm2-abrmd
and talk to swtpm directly but the tcti module to do that isn't
available as a package, yet.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

man/man8/swtpm-create-tpmca.8

@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 4.11 (Pod::Simple 3.35)
+.\" Automatically generated by Pod::Man 4.12 (Pod::Simple 3.39)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "swtpm-create-tpmca 8"
-.TH swtpm-create-tpmca 8 "2018-10-17" "swtpm" ""
+.TH swtpm-create-tpmca 8 "2020-04-14" "swtpm" ""
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -209,6 +209,19 @@ The hostname where tcsd is running on. The default hostname is 'localhost'.
 .IX Item "-tss-tcsd-port"
 The \s-1TCP\s0 port on which tcsd is listening for messages. The default port is
 30003.
+.IP "\fB\-\-tpm2\fR" 4
+.IX Item "--tpm2"
+The \s-1TPM\s0 to use for signing the certificates is a \s-1TPM 2\s0 and Intel's \s-1TSS\s0 stack
+must be running (tpm2\-abrmd) along with its \s-1PKCS11\s0 module.
+The \s-1TPM 2 PKCS11\s0 module must have been initialized using the tpm2_ptool.
+.Sp
+The environment variables \s-1SWTPM_PKCS11_PIN\s0 and \s-1SWTPM_PKCS11_SO_PIN\s0 should be
+set to hold the PINs. If \s-1SWTPM_PKCS11_PIN\s0 is not set then the default \s-1PIN\s0
+\&'swtpm\-tpmca' will be used. \s-1SWTPM_PKCS11_SO_PIN\s0 is needed for creating the
+token and must be explicitly set as an environment variable.
+.IP "\fB\-\-pid pimary-object-id\fR" 4
+.IX Item "--pid pimary-object-id"
+The primary object id that the tpm2_ptool returns upon 'init'.
 .IP "\fB\-help, \-h, \-?\fR" 4
 .IX Item "-help, -h, -?"
 Display the help screen and exit.
@@ -219,6 +232,9 @@ into /var/lib/swtpm\-localca and the swtpm-localca configuration to
 /etc/swtpm\-localca.conf. It can then be used for signing certificates of
 newly created \fBswtpm\fR TPMs.
 .PP
+If the host's \s-1TPM\s0 is a \s-1TPM 1.2,\s0 we need to start the tcsd first and can
+then create the \s-1TPM\s0 key and \s-1TPM CA\s0 certificate:
+.PP
 .Vb 10
 \& #> sudo systemctl start tcsd
 \& #> sudo /usr/share/swtpm/swtpm\-create\-tpmca \e
@@ -237,17 +253,57 @@ newly created \fBswtpm\fR TPMs.
 \& signingkey_password = password
 \& parentkey_password = password
 .Ve
+.PP
+Alternatively, if the host's \s-1TPM\s0 is a \s-1TPM 2\s0 and Intel's \s-1TPM 2\s0 stack is
+installed, we need to start tpm2\-abrmd first and can then create the \s-1TPM\s0 key
+and \s-1TPM CA\s0 certificate:
+.PP
+.Vb 10
+\& #> sudo systemctl start tpm2\-abrmd
+\& #> tpm2_ptool init
+\& action: Created
+\& id: 1                   # this is the \-\-pid parameter below
+\& #> sudo SWTPM_PKCS11_PIN="mypin 123" SWTPM_PKCS11_SO_PIN=123 /usr/share/swtpm/swtpm\-create\-tpmca \e
+\&                \-\-dir /var/lib/swtpm\-localca \e
+\&                \-\-overwrite \e
+\&                \-\-outfile /etc/swtpm\-localca.conf \e
+\&                \-\-group tss \e
+\&                \-\-tpm2 \e
+\&                \-\-pid 1
+\& statedir = /var/lib/swtpm\-localca
+\& signingkey = pkcs11:model=SW%20%20%20TPM\e;manufacturer=IBM\e;serial=0000000000000000\e;token=swtpm\-tpmca\-1\e;id=%31\e;object=swtpm\-tpmca\-key\e;type=private
+\& issuercert = /var/lib/swtpm\-localca/swtpm\-localca\-tpmca\-cert.pem
+\& certserial = /var/lib/swtpm\-localca/certserial
+\& SWTPM_PKCS11_PIN = mypin 123
+.Ve
+.PP
+Note: This also works for non-root users by adapting the \-\-dir and \-\-outfile
+parameters here and below by changing the \-\-dir parameter and adding a \-\-config
+parameter.
+.PP
+To test either one of the above \s-1TPM\s0 CAs, run the following command:
+.PP
+.Vb 5
+\& #> /usr/share/swtpm/swtpm\-localca \e
+\&        \-\-type ek \-\-ek x=11,y=13 \e
+\&        \-\-dir /tmp \-\-vmid test \-\-tpm2 \e
+\&        \-\-tpm\-spec\-family 2.0 \-\-tpm\-spec\-revision 146 \-\-tpm\-spec\-level 00 \e
+\&        \-\-tpm\-model swtpm \-\-tpm\-version 20170101 \-\-tpm\-manufacturer IBM
+.Ve
+.PP
+The \-\-tpm2 in this command indicates that the \s-1TPM\s0 for which the certificate
+is created is a \s-1TPM 2.\s0
 .SH "KNOWN ISSUES"
 .IX Header "KNOWN ISSUES"
 The interaction of GnuTLS certtool with the \s-1TPM TCSD\s0 daemon may cause so
-many \s-1TPM\s0 (key) authentication failures, that the \s-1TPM\s0 refuses to accept any
+many \s-1TPM\s0 (key) authentication failures that the \s-1TPM\s0 refuses to accept any
 more authenticated commands until the \s-1TPM\s0's owner sends it the
 TPM_ORD_ResetLockValue command. The reason for this is that certtool first
 tries to use 20 zero bytes for the \s-1SRK\s0 password and only then prompts for
 and uses the required \s-1SRK\s0 password. The GnuTLS tpmtool does not support 20
 zero bytes for the \s-1SRK\s0 password, so forces the usage of a 'real' password.
 .PP
-The effect of the authentication failues may be that the \s-1TPM CA\s0 cannot sign
+The effect of the authentication failures may be that the \s-1TPM CA\s0 cannot sign
 certificates since the \s-1TPM\s0 does not accept authenticated commands.
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"

man/man8/swtpm-create-tpmca.pod

@@ -85,6 +85,21 @@ The hostname where tcsd is running on. The default hostname is 'localhost'.
 The TCP port on which tcsd is listening for messages. The default port is
 30003.
 
+=item B<--tpm2>
+
+The TPM to use for signing the certificates is a TPM 2 and Intel's TSS stack
+must be running (tpm2-abrmd) along with its PKCS11 module.
+The TPM 2 PKCS11 module must have been initialized using the tpm2_ptool.
+
+The environment variables SWTPM_PKCS11_PIN and SWTPM_PKCS11_SO_PIN should be
+set to hold the PINs. If SWTPM_PKCS11_PIN is not set then the default PIN
+'swtpm-tpmca' will be used. SWTPM_PKCS11_SO_PIN is needed for creating the
+token and must be explicitly set as an environment variable.
+
+=item B<--pid pimary-object-id>
+
+The primary object id that the tpm2_ptool returns upon 'init'.
+
 =item B<-help, -h, -?>
 
 Display the help screen and exit.
@@ -98,6 +113,9 @@ into /var/lib/swtpm-localca and the swtpm-localca configuration to
 /etc/swtpm-localca.conf. It can then be used for signing certificates of
 newly created B<swtpm> TPMs.
 
+If the host's TPM is a TPM 1.2, we need to start the tcsd first and can
+then create the TPM key and TPM CA certificate:
+
  #> sudo systemctl start tcsd
  #> sudo /usr/share/swtpm/swtpm-create-tpmca \
 		--dir /var/lib/swtpm-localca \
@@ -115,17 +133,54 @@ newly created B<swtpm> TPMs.
  signingkey_password = password
  parentkey_password = password
 
+
+Alternatively, if the host's TPM is a TPM 2 and Intel's TPM 2 stack is
+installed, we need to start tpm2-abrmd first and can then create the TPM key
+and TPM CA certificate:
+
+ #> sudo systemctl start tpm2-abrmd
+ #> tpm2_ptool init
+ action: Created
+ id: 1                   # this is the --pid parameter below
+ #> sudo SWTPM_PKCS11_PIN="mypin 123" SWTPM_PKCS11_SO_PIN=123 /usr/share/swtpm/swtpm-create-tpmca \
+		--dir /var/lib/swtpm-localca \
+		--overwrite \
+		--outfile /etc/swtpm-localca.conf \
+		--group tss \
+		--tpm2 \
+		--pid 1
+ statedir = /var/lib/swtpm-localca
+ signingkey = pkcs11:model=SW%20%20%20TPM\;manufacturer=IBM\;serial=0000000000000000\;token=swtpm-tpmca-1\;id=%31\;object=swtpm-tpmca-key\;type=private
+ issuercert = /var/lib/swtpm-localca/swtpm-localca-tpmca-cert.pem
+ certserial = /var/lib/swtpm-localca/certserial
+ SWTPM_PKCS11_PIN = mypin 123
+
+Note: This also works for non-root users by adapting the --dir and --outfile
+parameters here and below by changing the --dir parameter and adding a --config
+parameter.
+
+To test either one of the above TPM CAs, run the following command:
+
+ #> /usr/share/swtpm/swtpm-localca \
+	--type ek --ek x=11,y=13 \
+	--dir /tmp --vmid test --tpm2 \
+	--tpm-spec-family 2.0 --tpm-spec-revision 146 --tpm-spec-level 00 \
+	--tpm-model swtpm --tpm-version 20170101 --tpm-manufacturer IBM
+
+The --tpm2 in this command indicates that the TPM for which the certificate
+is created is a TPM 2.
+
 =head1 KNOWN ISSUES
 
 The interaction of GnuTLS certtool with the TPM TCSD daemon may cause so
-many TPM (key) authentication failures, that the TPM refuses to accept any
+many TPM (key) authentication failures that the TPM refuses to accept any
 more authenticated commands until the TPM's owner sends it the
 TPM_ORD_ResetLockValue command. The reason for this is that certtool first
 tries to use 20 zero bytes for the SRK password and only then prompts for
 and uses the required SRK password. The GnuTLS tpmtool does not support 20
 zero bytes for the SRK password, so forces the usage of a 'real' password.
 
-The effect of the authentication failues may be that the TPM CA cannot sign
+The effect of the authentication failures may be that the TPM CA cannot sign
 certificates since the TPM does not accept authenticated commands.
 
 =head1 SEE ALSO