GoKawiilDeveloper demonstrates binding mTLS client keys to a TPM to block key theft
A developer working on remote attestation for confidential VMs describes a technique for signing TLS handshake data using a private key generated and held inside a Trusted Platform Module, rather than storing it as a plain file on disk. The approach targets mutual TLS client authentication, where a stolen private key normally lets an attacker impersonate the machine anywhere that certificate is trusted.
GoKawiil's interpretation of the reporting above, not reported fact.
Client certificate files are routinely exposed through heap dumps, core files, swap, hypervisor snapshots, or code execution bugs, turning a supposed machine identity into a portable bearer credential. Tying the signing operation to hardware that never releases the key raises the bar for attackers who gain read access without full persistent control, which matters increasingly for confidential computing and zero-trust service authentication.
- The private key in mTLS is the real identity; the certificate is just public metadata.
- Storing keys as files leaves them vulnerable to memory dumps, swap, and filesystem-level attacks.
- Using a TPM to sign handshakes prevents key extraction but does not stop an attacker already running code on the machine.
Yubico YubiKey 5 NFC — If the article's point is that a private key living in a file isn't a real machine identity, a YubiKey applies the same idea to your own logins: the key is generated inside the hardware and never leaves it. It supports PIV client certificates, FIDO2/WebAuthn and OpenPGP, so you can sign and authenticate without a secret sitting on disk.
See Yubico YubiKey 5 NFC on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bschaatsbergen.com — Bruno Schaatsbergen, 2026-09-06
Published there as: “Signing TLS handshakes inside a TPM”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.