saving external certificate in tpm in java

[anusha3ali]

Hi Guys!
I am relatively new here and exploring different functionalities of TPM.
There is a use case in which I am going to receive digital root certificate from one API and I have to save that certificate in TPM. To test with java implementation of TSS, I generated X509Certificate using keyPairGenerator with RSA algorithm and defined signatureAlgorithm as SHA256WithRSAEncryption in X509V3CertificateGenerator object. After that I have converted that certificate to the TPMT_PUBLIC object and have called LoadExternal function of tpm to save it in TPM.
I am receiving TPM ERROR: {HASH} from the TPM and I am unable to find the root cause of it. I will be grateful if any of you can pin point what I am doing wrong. I have attatched relevant code snippets below,

private static final String CERTIFICATE_ALGORITHM = "RSA";
private static final String CERTIFICATE_DN = "CN=cn, O=o, L=L, ST=il, C= c";
private static final String CERTIFICATE_NAME = "keystore.test";
private static final int CERTIFICATE_BITS = 1024;
public static void  saveCertificateInTPM(X509Certificate csr) throws IOException, CertificateEncodingException {
    Tpm tpm = TpmFactory.platformTpm();
    tpm.Startup(TPM_SU.CLEAR);
    TPMT_PUBLIC cert = convertCertificateToTPMPublic(csr);
    TPM_HANDLE certHandler = tpm.LoadExternal(null, cert, TPM_HANDLE.from(TPM_RH.NULL));
    tpm.FlushContext(certHandler);
    tpm.close();

}
  private static TPMT_PUBLIC convertCertificateToTPMPublic(X509Certificate certificate) {
    // Convert the X.509 certificate to a TPMT_PUBLIC object compatible with the TPM
    // Extract the necessary information from the certificate (e.g., public key, algorithm) and set it in the TPMT_PUBLIC object
    // Return the TPMT_PUBLIC object
    // Example:
    TPMT_PUBLIC publicArea = new TPMT_PUBLIC();
    Map<String, TPM_ALG_ID> algorithmMap = new HashMap<>();
    algorithmMap.put("RSA", TPM_ALG_ID.RSA);
    algorithmMap.put("EC", TPM_ALG_ID.ECC);
    algorithmMap.put("SHA", TPM_ALG_ID.SHA256);
    TPM_ALG_ID tpmAlgorithm = algorithmMap.getOrDefault(certificate.getPublicKey().getAlgorithm(), TPM_ALG_ID.NULL);
    TPM2B_PUBLIC_KEY_RSA unique = new TPM2B_PUBLIC_KEY_RSA();
    System.out.println(certificate.getSigAlgName());
    unique.buffer=  certificate.getPublicKey().getEncoded();
    TPMS_RSA_PARMS params=new TPMS_RSA_PARMS();
    params.symmetric=new TPMT_SYM_DEF_OBJECT();
    params.symmetric.algorithm=TPM_ALG_ID.NULL;
    params.scheme=new TPMS_SIG_SCHEME_RSASSA(TPM_ALG_ID.SHA256);
    return new TPMT_PUBLIC(tpmAlgorithm, TPMA_OBJECT.fixedTPM, null, params, unique);
}

 public static X509Certificate generateSelfSignedCertificate() throws SignatureException, InvalidKeyException, 
    NoSuchAlgorithmException {
    X509Certificate cert = null;
    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(CERTIFICATE_ALGORITHM);
    keyPairGenerator.initialize(CERTIFICATE_BITS, new SecureRandom());
    KeyPair keyPair = keyPairGenerator.generateKeyPair();

    // GENERATE THE X509 CERTIFICATE
    X509V3CertificateGenerator v3CertGen =  new X509V3CertificateGenerator();
    v3CertGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
    v3CertGen.setIssuerDN(new X509Principal(CERTIFICATE_DN));
    v3CertGen.setNotBefore(new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24));
    v3CertGen.setNotAfter(new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365*10)));
    v3CertGen.setSubjectDN(new X509Principal(CERTIFICATE_DN));
    v3CertGen.setPublicKey(keyPair.getPublic());
    v3CertGen.setSignatureAlgorithm("SHA256WithRSAEncryption");
    cert = v3CertGen.generateX509Certificate(keyPair.getPrivate());
    return cert;
}