---
name: "systemd-tpm2-setup.service"
section: "8"
platform: "linux"
package: "systemd"
version: "262.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/systemd-tpm2-setup.service"
---

# systemd-tpm2-setup.service(8)

Set up the TPM2 Storage Root Key (SRK), Endorsement Key (EK), and initialize NvPCRs at boot

## NAME

systemd-tpm2-setup.service, systemd-tpm2-setup-early.service, systemd-tpm2-setup - Set up the TPM2 Storage Root Key (SRK), Endorsement Key (EK), and initialize NvPCRs at boot

## SYNOPSIS

systemd-tpm2-setup.service

/usr/lib/systemd/systemd-tpm2-setup

## DESCRIPTION

systemd-tpm2-setup.service and systemd-tpm2-setup-early.service are services that generate the Storage Root Key (SRK) and Endorsement Key (EK) if they have not been generated yet, and stores them in the TPM. If NvPCRs (additional PCR registers in TPM NV Indexes) are defined, these are initialized with the anchoring secret.

The services will store the public key of the SRK key pair in a PEM file in /run/systemd/tpm2-srk-public-key.pem and /var/lib/systemd/tpm2-srk-public-key.pem. They will also store it in TPM2B\_PUBLIC format in /run/systemd/tpm2-srk-public-key.tpm2\_public and /var/lib/systemd/tpm2-srk-public-key.tpm2b\_public.

systemd-tpm2-setup-early.service runs very early at boot (possibly in the initrd), and writes the SRK public key to /run/systemd/tpm2-srk-public-key.\* (as /var/ is generally not accessible this early yet), while systemd-tpm2-setup.service runs during a later boot phase and saves the public key to /var/lib/systemd/tpm2-srk-public-key.\*.

## FILES

/run/systemd/tpm2-srk-public-key.pem, /run/systemd/tpm2-srk-public-key.tpm2b\_public

The SRK public key in PEM and TPM2B\_PUBLIC format, written during early boot.

Added in version 255.

/var/lib/systemd/tpm2-srk-public-key.pem, /var/lib/systemd/tpm2-srk-public-key.tpm2\_public

The SRK public key in PEM and TPM2B\_PUBLIC format, written during later boot (once /var/ is available).

Added in version 255.

/usr/lib/nvpcr/\*.nvpcr

Definition files for NvPCRs.

Added in version 259.

## SEE ALSO

[**systemd**(1)](/systemd/1.md)