Moving RAUC's HTTPS Streaming Key into TPM2 via PKCS#11

Migrating RAUC’s mTLS client key from a file on disk to a TPM2-backed PKCS#11 URI. The recipe wiring was straightforward; the URI was not. module-path is a p11-kit URI extension that libp11 — the parser RAUC’s streaming path actually uses — rejects outright.

April 23, 2026 · 11 min · Umair Ahmed Shah