Home Knowledge Base SecureW2 Documentation TPM Key Attestation Configuration and Enrollment (Linux)

TPM Key Attestation Configuration and Enrollment (Linux)

Introduction

SecureW2 TPM-based key attestation can be integrated with the certificate enrollment workflow to ensure that private keys are securely generated, stored, and validated within trusted hardware.

When an IoT device submits a Certificate Signing Request (CSR), the server cannot determine whether the private key is hardware-protected or software-generated. A TPM attestation validation server ensures that (1) the key is hardware-bound and non-exportable, and (2) the TPM is genuine and vendor-trusted. This guarantees that the issued certificate is cryptographically bound to a specific physical device and cannot be used without its TPM.

The following guide provides step-by-step instructions on setting up TPM Key Attestation for certificate enrollment.

Prerequisites

The following are the prerequisites for setting up TPM key attestation with Linux:

  1. Access to the JoinNow Management Portal with an Ultimate or Absolute subscription for GBB or an Enterprise Enrollment and Attestation (EEA) subscription for Legacy.
  2. TPM 2.0 is available and enabled on the Linux machine.

Configuring JoinNow

The following are the high-level steps to be configured in JoinNow:

  1. Creating an Intermediate CA
  2. Creating a Simple Device Enrollment Token
  3. Configure Key Attestation Platform
  4. Configuring Policy Management

Creating an Intermediate CA

As a best practice, SecureW2 recommends having a new intermediate CA for TPM-based attestation.

To create a new intermediate CA:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Dynamic PKI > Certificate Authorities. 
  3. Click Add Certificate Authority.
  4. In the Basic section, select the Device and User Authentication option from the Generate CA For drop-down list to authenticate devices and users.
  5. From the Type drop-down list, select Intermediate CA.
  6. From the Certificate Authority drop-down list, select the default Root CA for your organization.
  7. In the Common Name field, enter a common name for the CA certificate. 
  8. From the Key Size drop-down list, select 2048 for the CA certificate key pair. 
  9. From the Signature Algorithm drop-down list, select the signature algorithm for the certificate signing request. The option available is SHA-256.
  10. In the Validity Period (in years) field, enter the validity period of the CA certificate.
  11. Click Save. The new intermediate CA is generated.

Creating Simple Device Enrollment Token

The Simple Device Enrollment Token is a static API key used to authenticate devices during enrollment. It was previously part of the TPM Attestation Provider configuration and could be created only during TPM attestation setup, but it is now a standalone token. 

To create a Simple Device Enrollment Token, perform the following steps:

  1. Navigate to Integration Hub > Device Management Platforms.
  2. Click Add.
  3. In the Name field, enter a name for the token.
  4. In the Description box, enter a description for the token.
  5. From the Type list, select Simple Device Enrollment Token. With this token type, you can authenticate devices during enrollment without configuring TPM attestation.
  6. Click Save. A .csv file containing the API Key ID, API Secret, and Enrollment URL is downloaded.

Configure Key Attestation Platform

This section describes the steps to configure a key attestation platform for TPM.

  1. Navigate to Integration Hub > Key Attestation Platforms. 
  2. Click Add.
  3. In the Name field, enter a name for the key attestation platform.
  4. In the Display Description field, enter a suitable description for the key attestation platform.
  5. From the Type drop-down list, select TPM.
  6. From the Manufacturer drop-down list, select the trusted vendor that manufactured the TPM chip. SecureW2 currently supports AMD and Infineon.

     

    NOTE: Select Other in the Manufacturer field and manually enter a manufacturer that is not listed.

  7. Click Save.

Configuring Custom TPM Manufacturer

If the TPM chip’s manufacturer is not listed in the Manufacturer drop-down, Admin can select Other to manually enter the manufacturer, add the Manufacturer Root CA, and specify the whitelisted domains for the AIA URL.

This section describes the steps to configure a custom manufacturer for TPM.

  1. Navigate to Integration Hub > Key Attestation Platforms. 
  2. Click Add.
  3. In the Name field, enter a name for the key attestation platform.
  4. In the Display Description field, enter a suitable description for the key attestation platform.
  5. From the Type drop-down list, select TPM.
  6. From the Manufacturer drop-down list, select Other.
  7. In the Manufacturer Name field, enter the manufacturer’s name.
  8. Click Save. Click the Configuration tab.
    1. In the Manufacturer Root CA field, click Choose file to locate and upload the root certificate.
    2. In the Whitelisted Domains field, enter the whitelisted domain and click Upload.
  9. Click Update.

Configuring Policy Management

The following policies must be created in JoinNow for TPM-based certificate enrollment.

  1. Policy Workflow
  2. Device Role 
  3. Enrollment

Creating a Policy Workflow

  1. Go to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic section, in the Name field, enter a name for the policy.
  4. In the Description field, enter a description for the policy.
  5. Click Save. The page refreshes and automatically selects the Conditions tab.
  6. In the Conditions section, click the Core Provider drop-down and select the Device Management Platform created in the Creating Simple Device Enrollment Token section.
  7. Click Update.

Creating a Device Role Policy

Device Role Policy helps in mapping the attestation provider in JoinNow for device attestation.

  1. From the JoinNow Management Portal, go to Policy Management > Device Role.
  2. Click Add Device Role Policy.
  3. In the Basic tab, enter a name in the Name field.
  4. For Display Description, enter a description.
  5. Click Save. The page refreshes, and the Conditions tab opens.
  6. Click on the Conditions tab.
  7. From the Identity drop-down, select the Key Attestation Provider created in the Configure Key Attestation Platform section.
  8. Click Update.

Creating an Enrollment

  1. From the JoinNow Management Portal, go to Policy Management > Enrollment.
  2. Click Add Enrollment Policy.
  3. In the Basic tab, for Name, enter a name.
  4. For Description, enter a description.
  5. Click Save. The page refreshes and displays the Conditions and Settings tab.
  6. In the Conditions section, for Role, select the user role policy you created in the Creating a Policy Workflow section.
  7. For Device Role, select the device role created in the Creating a Device Role Policy section.
  8. Click on the Settings tab.
  9. From the Use Certificate Authority drop-down, select the intermediate CA created for TPM-based attestation.
  10. From the Use Certificate Template drop-down list, choose the DEFAULT CREATE CERTIFICATE TEMPLATE 1.
  11. Click Update.

Importing TPM IoT Agent from JoinNow

To download the TPM agent required for a Linux machine:

  1. Navigate to Downloads > Enrollment Gateway.
  2. Click the Download button adjacent to the TPM Agent.

Configuring Linux

The following steps configure a Linux machine for TPM-based certificate enrollment.

  1. Install TPM 2.0 tools using the following command – sudo apt install tpm2-tools.
  2. To verify the TPM Manufacturer, use the “tpm2_getcap properties-fixed” command.

    Example output:

    1. TPM_IFX → Infineon
    2. TPM_AMD → AMD
  3. Import and extract the ZIP file downloaded from the JoinNow Management Portal in Importing TPM IoT Agent from JoinNow. The following files will be extracted:
      1. Sp
      2. verify-tpm.sh
  4. Create a folder using the “mkdir tpm-enroll” command.
  5. Move the files to the created folder using “mv sp verify-tpm.sh tpm-enroll/”
  6. Enter the folder using “cd tpm-enroll”
  7. Perform the following command to download the Prerequisite Packages
				
					### Install everything in ONE apt transaction


```bash
sudo apt update
sudo apt install \
    tpm2-tools \
    libtpm2-pkcs11-1 \
    libtpm2-pkcs11-tools \
    libengine-pkcs11-openssl \
    opensc \
    wpasupplicant \
    util-linux-extra
```
  1. Run the following enrollment command:
				
					./sp enroll \
 --url "Enrollment URI" \
 --identity "user@example.com" \
 --psk "API Secret" \
 --output-dir  <folderName>   --install-nm-profile   --set wifi.ssid=<SSID>   --set wifi.server_ca=<server_ca_path>   --set wifi.domain_suffix_match=<domainName>

NOTE: Use the Enrollment URL and API Secret created earlier in the Creating Simple Device Enrollment Token section

Sample Command:

				
					sudo ./sp enroll   --url "https://api-staging.securew2.com/urltokenid/74b34ad0-b16d-42c8-9874-8e7005fdeab9/enroll/2920ed9d-e23c-4970-a6d3-e57657301bdc"   

--identity user123@securew2.com

 --psk uvsv8kp9j7ejupi5dslg0l1hia   

--output-dir /home/securew2/Downloads/TPM   --install-nm-profile   --set wifi.ssid=GCP   --set wifi.server_ca=/home/securew2/Downloads/digicert-g3.pem   --set wifi.domain_suffix_match=securew2.com

Enrollment and RADIUS for Wired (802.1X)

In addition to Wi-Fi, the sp enroll command supports wired 802.1X enrollment using the following flags. Once enrolled, the RADIUS authentication status for the wired connection can be verified on the RADIUS Events page.

  1. –ethernet – Enables wired 802.1X enrollment. The Ethernet interface is auto-detected.
  2. –ethernet-server-ca – Specifies the path to the server CA certificate for the wired connection.
  3. –ethernet-domain-suffix-match – Specifies the domain suffix to match against the server certificate for the wired connection.

3.1.1 Ethernet-only

				
					sudo ./sp enroll\  
  --url "<ENROLLMENT_URL>" \
  --identity "user@example.com" \
  --psk <PSK> \
  --output-dir <folderName> \
  --install-nm-profile \
  --ethernet \
  --ethernet-server-ca <server_ca_path> \
  --ethernet-domain-suffix-match <domainName>

NOTE: Use the Enrollment URL and API Secret created earlier in the Creating Simple Device Enrollment Token section

Sample Command:
				
					sudo ./sp enroll \
  --url "https://api-staging.securew2.com/urltokenid/74b34ad0-b16d-42c8-9874-8e7005fdeab9/enroll/2920ed9d-e23c-4970-a6d3-e57657301bdc" \
  --identity user123@securew2.com \
  --psk uvsv8kp9j7ejupi5dslg0l1hia \
  --output-dir /home/sw2/Downloads/TPM2 \
  --install-nm-profile \
  --ethernet \
  --ethernet-server-ca /home/sw2/Downloads/digicert-g3.pem \
  --ethernet-domain-suffix-match=securew2.com

3.1.2 Wi-Fi-only

				
					sudo ./sp enroll \
  --url "<ENROLLMENT_URL>" \
  --identity "user@example.com" \
  --psk <PSK> \
  --output-dir <folderName> \
  --install-nm-profile \
  --set wifi.ssid=<SSID> \
  --set wifi.server_ca=<server_ca_path> \
  --set wifi.domain_suffix_match=<domainName>
Sample Command:
				
					sudo ./sp enroll \
  --url "<ENROLLMENT_URL>" \
  --identity user123@securew2.com \
  --psk uvsv8kp9j7ejupi5dslg0l1hia \
  --output-dir /home/sw2/Downloads/TPM2 \
  --install-nm-profile \
  --set wifi.ssid=851Releaseorg \
  --set wifi.server_ca=/home/sw2/Downloads/digicert-g3.pem \
  --set wifi.domain_suffix_match=securew2.com

3.1.3 Wi-Fi and Ethernet together

				
					sudo ./sp enroll \
  --url "<ENROLLMENT_URL>" \
  --identity "user@example.com" \
  --psk <PSK> \
  --output-dir <folderName> \
  --install-nm-profile \
  --set wifi.ssid=<SSID> \
  --set wifi.server_ca=<server_ca_path> \
  --set wifi.domain_suffix_match=<domainName> \
  --ethernet \
  --ethernet-server-ca <server_ca_path> \
  --ethernet-domain-suffix-match <domainName>
Sample Command:
				
					sudo ./sp enroll \
  --url ""https://api-staging.securew2.com/urltokenid/74b34ad0-b16d-42c8-9874-8e7005fdeab9/enroll/2920ed9d-e23c-4970-a6d3-e57657301bdc" \
  --identity user123@securew2.com \
  --psk uvsv8kp9j7ejupi5dslg0l1hia \
  --output-dir /home/sw2/Downloads/TPM2 \
  --install-nm-profile \
  --set wifi.ssid=851Releaseorg \
  --set wifi.server_ca=/home/sw2/Downloads/digicert-g3.pem \
  --set wifi.domain_suffix_match=securew2.com \
  --ethernet \
  --ethernet-server-ca /home/sw2/Downloads/digicert-g3.pem \
  --ethernet-domain-suffix-match securew2.com

NOTE: Both media can be enrolled in a single command. If one connection type fails, it does not block the other from completing.

Enhanced Events

Admins can check the enrollment success message on the Enhanced Events page under Data and Monitoring:

RADIUS Events

Similarly, admins can check the RADIUS success message on the RADIUS Events page under Data and Monitoring:

More SecureW2 Documentation Explainers
Reseller or MSP? Join our Partner Program