What are the best practices for managing TPM keys and certificates in your organization?

2 Enabling and activating the TPM

Before you can use the TPM, you need to enable and activate it in the BIOS or UEFI settings of your computer. This will allow the TPM to communicate with the operating system and the applications that use it. You may also need to set a password or a PIN to protect the access to the TPM. You should use a strong and unique password or PIN that is not shared with anyone else. You should also keep a backup of your password or PIN in a secure location, in case you forget it or need to reset the TPM.

3 Managing the ownership and authorization of the TPM

The ownership and authorization of the TPM determine who can use the keys and certificates that are stored in it. The ownership is established when you take control of the TPM and create a storage root key (SRK), which is the master key for the TPM. The authorization is granted when you provide a password or a PIN to access the TPM or a specific key or certificate. You should manage the ownership and authorization of the TPM carefully, to prevent unauthorized or malicious use. You should also avoid changing the ownership or resetting the TPM frequently, as this may erase the keys and certificates and cause compatibility issues.

4 Creating and using TPM keys and certificates

The TPM can create and use different types of keys and certificates, such as endorsement keys (EKs), attestation identity keys (AIKs), binding keys, signing keys, encryption keys, and platform configuration registers (PCRs). These keys and certificates can be used for various purposes, such as verifying the identity and integrity of your system, encrypting and decrypting data, signing and verifying documents, and measuring and reporting the system state. You should create and use TPM keys and certificates according to your security requirements and best practices, such as using different keys for different purposes, limiting the number and size of keys, and storing them securely in the TPM or in external media.

5 Updating and revoking TPM keys and certificates

The TPM keys and certificates may need to be updated or revoked over time, due to changes in the system configuration, security policies, or standards. For example, you may need to update the EK or AIK if you change the TPM type, or revoke a binding key if you lose the encrypted data. You should update and revoke TPM keys and certificates regularly, to maintain the security and validity of your system. You should also keep track of the updates and revocations, and notify the relevant parties, such as your IT department, your service provider, or your certificate authority.

6 Backing up and restoring TPM keys and certificates

The TPM keys and certificates are valuable assets that should be protected from loss or damage. However, there may be situations where you need to back up or restore them, such as when you upgrade or replace your hardware, when you migrate to a new system, or when you recover from a disaster. You should back up and restore TPM keys and certificates carefully, to avoid compromising their security or functionality. You should also use appropriate tools and methods, such as the TPM management console, the BitLocker recovery key, or the Trusted Platform Module Management command-line tool.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?