tpm2_getekcertificate - Man Page

Retrieve the Endorsement key Certificate.


tpm2_getekcertificate [Options] [ARGUMENT]


tpm2_getekcertificate(1) - Retrieve the endorsement key certificate. The certificate is present either on the TCG specified TPM NV indices OR on the TPM manufacturer's endorsement certificate hosting server. Following are the conditions dictating the certificate location lookup.

  1. NV-Index:

    Default search location when ARGUMENT is not specified.

  2. Intel-EK-certificate-server:

    Search location when EK certificate could not be found in the NV index AND tpmEPSgenerated bit is CLEAR AND manufacturer is INTC.

  3. Intel-EK-Re-certification-server:

    Search location when EK certificate could not be found in the NV index AND tpmEPSgenerated bit is SET AND manufacturer is INTC.


    In this operation information is provided regarding additional software to be run as part of the re-provisioning/ re-certification service.

    After re-provisioning/ recertification process is complete, EK certificates can be read from the NV indexes by running another instance of tpm2_getekcertificate.

  4. Generic or other EK-certificate-server:

    Search location when ARGUMENT specifies the EK certificate web hosting address.



Common Options

This collection of options are common to many programs and provide information that many users may expect.

TCTI Configuration

The TCTI or "Transmission Interface" is the communication mechanism with the TPM. TCTIs can be changed for communication with TPMs across different mediums.

To control the TCTI, the tools respect:

  1. The command line option -T or --tcti
  2. The environment variable: TPM2TOOLS_TCTI.

Note: The command line option always overrides the environment variable.

The current known TCTIs are:

The arguments to either the command line option or the environment variable are in the form:


Specifying an empty string for either the <tcti-name> or <tcti-option-config> results in the default being used for that portion respectively.

TCTI Defaults

When a TCTI is not specified, the default TCTI is searched for using dlopen(3) semantics. The tools will search for tabrmd, device and mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND. You can query what TCTI will be chosen as the default by using the -v option to print the version information. The "default-tcti" key-value pair will indicate which of the aforementioned TCTIs is the default.

Custom TCTIs

Any TCTI that implements the dynamic TCTI interface can be loaded. The tools internally use dlopen(3), and the raw tcti-name value is used for the lookup. Thus, this could be a path to the shared library, or a library name as understood by dlopen(3) semantics.

Tcti Options

This collection of options are used to configure the various known TCTI modules available:


When the verbose option is specified, additional curl debugging information is provided by setting the curl mode verbose, see <> for more information.


Retrieve EK certificate from TPM manufacturer backend by supplying

EK public.

tpm2_createek -G rsa -u -c key.ctx

tpm2_getekcertificate -X -o ECcert.bin -u \

Retrieve EK certificate from Intel backend if certificate not found

on NV.

tpm2_createek -G rsa -u -c key.ctx

tpm2_getekcertificate -X -o ECcert.bin -u

Retrieve EK certificate from Intel backend for an offline platform.

tpm2_getekcertificate -X -x -o ECcert.bin -u

Retrieve EK certificate from TPM NV indices only, fail otherwise.

tpm2_getekcertificate -o ECcert.bin

Retrieve multiple EK certificates from TPM NV indices only, fail


tpm2_getekcertificate -o RSA_EK_cert.bin -o ECC_EK_cert.bin


Tools can return any of the following codes:


Github Issues (


See the Mailing List (


tpm2-tools General Commands Manual