---
name: "pt-tls-client"
section: "1"
platform: "linux"
package: "libcharon-extra-plugins"
version: "6.0.1-6+deb13u6"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pt-tls-client"
---

# pt-tls-client(1)

Simple client using PT-TLS to collect integrity information

## NAME

pt-tls-client - Simple client using PT-TLS to collect integrity information

## SYNOPSIS

**pt-tls-client** **--connect** *hostname*\|*address* \[**--port** *port*\] \[**--certid** *hex*\|**--cert** *file*\]+ \[**--keyid** *hex*\|**--key** *file*\] \[**--key-type** **rsa**\|**ecdsa**\] \[**--client** *client-id*\] \[**--secret** *password*\] \[**--mutual**\] \[**--options** *filename*\] \[**--quiet**\] \[**--debug** *level*\]

**pt-tls-client** **-h** \| **--help**

## DESCRIPTION

**pt-tls-client** is a simple client using the PT-TLS (RFC 6876) transport protocol to collect integrity measurements on the client platform. PT-TLS does an initial TLS handshake with certificate-based server authentication and optional certificate-based client authentication.  Alternatively simple password-based SASL client authentication protected by TLS can be used.

Attribute requests and integrity measurements are exchanged via the PA-TNC (RFC 5792) message protocol between any number of Integrity Measurement Verifiers (IMVs) residing on the remote PT-TLS server and multiple Integrity Measurement Collectors (IMCs) loaded dynamically by the PT-TLS client according to a list defined by */etc/tnc\_config*. PA-TNC messages that contain one or several PA-TNC attributes are multiplexed into PB-TNC (RFC 5793) client or server data batches which in turn are transported via PT-TLS.

## OPTIONS

- **-h, --help**

  Prints usage information and a short summary of the available commands.

- **-c, --connect** *hostname\|address*

  Set the hostname or IP address of the PT-TLS server.

- **-p, --port** *port*

  Set the port of the PT-TLS server, default: 271.

- **-x, --cert** *file*

  Set the path to an X.509 certificate file. This option can be repeated to load multiple client and CA certificates.

- **-X, --certid** *hex*

  Set the handle of the certificate stored in a smartcard or a TPM 2.0 Trusted Platform Module.

- **-k, --key** *file*

  Set the path to the client's PKCS#1 or PKCS#8 private key file

- **-t, --key-type** *type*

  Define the type of the private key if stored in PKCS#1 format. Can be omitted with PKCS#8 keys.

- **-K, --keyid** *hex*

  Set the keyid of the private key stored in a smartcard or a TPM 2.0 Trusted Platform Module.

- **-i, --client** *client-id*

  Set the username or client ID of the client required for password-based SASL authentication.

- **-s, --secret** *password*

  Set the preshared secret or client password required for password-based SASL authentication.

- **-q, --mutual**

  Enable mutual attestation between PT-TLS client and PT-TLS server.

- **-v, --debug** *level*

  Set debug level, default: 1.

- **-q, --quiet**

  Disable debug output to stderr.

- **-+, --options** *file*

  Read command line options from *file*.

## EXAMPLES

Connect to a PT-TLS server using certificate-based authentication, storing the private ECDSA key in a file:

```
  pt-tls-client --connect pdp.example.com --cert ca.crt \
                --cert client.crt --key client.key --key-type ecdsa
```

Connect to a PT-TLS server using certificate-based authentication, storing the private key in a smartcard or a TPM 2.0 Trusted Platform Module:

```
  pt-tls-client --connect pdp.example.com --cert ca.crt \
                --cert client.crt --keyid 0x81010002
```

Connect to a PT-TLS server listening on port 443, using SASL password-based authentication:

```
  pt-tls-client --connect pdp.example.com --port 443 --cert ca.crt \
                --client jane --password p2Nl9trKlb
```

## FILES

- /etc/tnc\_config

  ## SEE ALSO

[**strongswan.conf**(5)](/strongswan.conf/5.md)