systemd systemd-tpm2-setup.service 8 systemd-tpm2-setup.service systemd-tpm2-setup-early.service systemd-tpm2-setup Set up the TPM2 Storage Root Key (SRK) at boot systemd-tpm2-setup.service /usr/lib/systemd/systemd-tpm2-setup systemd-tpm2-setup.service and systemd-tpm2-setup-early.service are services that generate the Storage Root Key (SRK) if it hasn't been generated yet, and stores it in the TPM. The services will store the public key of the SRK key pair in a PEM file in /run/systemd/tpm2-srk-public-key.pem and /var/lib/systemd/tpm2-srk-public-key.pem. systemd-tpm2-setup-early.service runs very early at boot (possibly in the initrd), and writes the SRK public key to /run/systemd/tpm2-srk-public-key.pem (as /var/ is generally not accessible this early yet), while systemd-tpm2-setup.service runs during a later boot phase and saves the public key to /var/lib/systemd/tpm2-srk-public-key.pem. /run/systemd/tpm2-srk-public-key.pem The SRK public key in PEM format, written during early boot. /var/lib/systemd/tpm2-srk-public-key.pem The SRK public key in PEM format, written during later boot (once /var/ is available). systemd1