TPM Support for Keys

[rsherwood-faa]

I am working on secure key storage via TPM for my client. I am investigating using Posh for this use case, and I want to see if anyone has already tried this, and if you would accept a pull request if I get it working.

I will use this document as guidance to start working on the problem: https://docs.digicert.com/en/device-trust-manager/tutorials/generate-and-manage-tpm-protected-keys-in-windows-using-powershell.html

Let me know if you have any additional recommendations or requests as I begin the analysis. I will keep you up to date on my progress.

[rmbolger]

Hey @rsherwood-faa, thanks for reaching out. I don't personally know of anyone who has tried this. But the basics in the article you linked should work without any changes to the current module. It would effectively be using Posh-ACME's existing ability to accept externally generated CSRs. So at step 4, you'd run New-PACertificate -CSRPath $csrPath with whatever additional parameters you need to satisfy the challenges.

Keep in mind though that this is only putting the certificate's private key in the TPM. There's a separate ACME account key that would not be in the TPM and depending on the config, another AES key used to encrypt the secrets in any provided PluginArgs. Adding native support to store those in a TPM is a much bigger lift, particularly around how to deal with cross-platform support.