Certificate Signing Request generation with tpm2-pkcs11

tpm2-pkcs11-csr.sh

#!/bin/bash

set -euxo pipefail

export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
export TPM2_PKCS11_TCTI="device:/dev/tpmrm0"
#export TPM2_PKCS11_LOG_LEVEL=2

tpm2_print_handles () {
  for i in transient saved-session loaded-session;
  do
     tpm2_getcap handles-$i;
  done
}

tpm2_flush_handles () {
  for i in transient-object saved-session loaded-session;
  do
     tpm2_flushcontext --$i;
  done
}

tpm2_clear
rm tpm2_pkcs11.sqlite3
tpm2_ptool init
tpm2_ptool addtoken --pid=1 --sopin=mysopin --userpin=myuserpin --label=label
tpm2_ptool addkey --algorithm=rsa2048 --label=label --userpin=myuserpin
tpm2_ptool config --key tcti --value "device:/dev/tpmrm0" --label label
p11-kit list-modules
TOKEN=$(p11tool --list-token-urls | grep "token=label")
expect <(cat <<EOF
spawn p11tool --login --list-all "${TOKEN}" --outfile p11tool.out
expect "Enter PIN: "
send -- "myuserpin\r"
interact
EOF
)

RANDOM=$$
ID=${RANDOM}
KEY=$(cat p11tool.out | grep private | awk '{ print $2 }')
SUBJ="/C=FR/ST=Radius/L=Somewhere/O=Example Inc./CN=testing-${ID}/emailAddress=testing-${ID}@123.com"
openssl req -new -engine pkcs11 -keyform engine -key "${KEY};pin-value=myuserpin" -subj "${SUBJ}" -out client-${ID}.csr

# Sign CSR in RADIUS Server with openssl
#
# cd /etc/raddb/certs
# openssl ca \
#       -batch -keyfile ./ca.key -cert ./ca.pem -passin pass:whatever \
#       -in client-${ID}.csr -out client-${ID}.crt \
#       -extensions xpclient_ext -extfile xpextensions
#       -config client.cnf

cat <<EOF > wpa_supplicant-${ID}.conf
network={
        ssid="SSID"
        key_mgmt=WPA-EAP
        eap=TLS
        identity="testing"
        ca_cert="./ca.pem"
        client_cert="./client-${ID}.crt"
        private_key="${KEY}"
        pin="myuserpin"
}
EOF

echo "wpa_supplicant -c wpa_supplicant-${ID}.conf -i wlp1s0"

#/bin/bash

set -euxo pipefail

cd tpm2-tss
git clean -fxd
git checkout 2.3.0
./bootstrap && ./configure && make -j4 && make install
cd ..

export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/

cd tpm2-tools
git clean -fxd
git checkout 4.0.1
./bootstrap && ./configure && make -j4 && make install
cd ..

cd tpm2-pkcs11
git clean -fxd
git checkout 1.0
./bootstrap && ./configure && make -j4 && make install
cd tools && python3 setup.py install && cd ..
cd ..

[root@localhost ~]# ldd /usr/lib64/pkcs11/libtpm2_pkcs11.so
        linux-vdso.so.1 (0x00007ffe2f3e7000)
        libtss2-esys.so.0 => /usr/local/lib/libtss2-esys.so.0 (0x00007f95a2714000)
        libtss2-sys.so.0 => /usr/local/lib/libtss2-sys.so.0 (0x00007f95a26eb000)
        libtss2-mu.so.0 => /usr/local/lib/libtss2-mu.so.0 (0x00007f95a26a3000)
        libtss2-tctildr.so.0 => /usr/local/lib/libtss2-tctildr.so.0 (0x00007f95a269a000)
        libtss2-rc.so.0 => /usr/local/lib/libtss2-rc.so.0 (0x00007f95a2690000)
        libsqlite3.so.0 => /lib64/libsqlite3.so.0 (0x00007f95a2571000)
        libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f95a228f000)
        libyaml-0.so.2 => /lib64/libyaml-0.so.2 (0x00007f95a226d000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007f95a2267000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f95a2246000)
        libc.so.6 => /lib64/libc.so.6 (0x00007f95a2080000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f95a27d5000)
        libm.so.6 => /lib64/libm.so.6 (0x00007f95a1f3a000)
        libz.so.1 => /lib64/libz.so.1 (0x00007f95a1f1e000)