How to tell openssl rsautl to use key stored in TPM?

Question

Is there any (easy) way to create a signature for a file using the command and the openssl rsautl command while the necessary key is stored in a TPM?

I just want to do the following with "key.pem" being a TPM-stored key.

openssl rsautl -sign -in file -inkey key.pem -out sig

Answer 1

How to tell openssl rsautl to use key stored in TPM?

OpenSSL does not provide an ENGINE for TPMs. I believe you need to use TrouSerS.

Dr. Henson made some comments about it on the OpenSSL mailing list at TPM engine.