openssl: Could not find private key of key from PK.key (TPM)

[m00nwtchr]

I'm trying to integrate sbctl with systemd-measure, as it would be nice if I could re-use the sbctl keys to sign the PCR policy as well. However, currently I'm stuck on trying to read the tpm-shielded private Platform Key file using openssl:

# openssl pkey -provider tpm2 -provider base -in PK.key -pubout -out testkey.pub
Could not find private key of key from PK.key
809BB60538750000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:crypto/store/store_result.c:151:

I confirmed that this command works with keys I've generated myself, but I can't get it to work with the sbctl created keys. (Except for normal file keys)

[Foxboron]

Probably this issue here: https://github.com/tpm2-software/tpm2-openssl/issues/120

[jejb]

If you simply need a tpm2 provider then the (slightly misnamed) openssl_tpm2_engine should give you one that supports almost all of the spec:

https://git.kernel.org/pub/scm/linux/kernel/git/jejb/openssl_tpm2_engine.git/

It's also build by openSUSE if you need rpms:

https://build.opensuse.org/package/show/security:tls/openssl_tpm2_engine