Debian · Secure Boot · TPM · LUKS2

Secure Boot Quickstart:
Debian + LUKS2 + Clevis TPM2

The single recommended path from a bare Debian install to a working TPM-backed auto-unlock, with nothing else. One method, one PCR policy, no branches. For the reasoning, the systemd-cryptenroll alternative, PCR theory, and troubleshooting, see the full Secure Boot Lab — this page exists so you don't have to read all of that just to stand up a VM.

Method: Clevis TPM2, PCR 7 only Companion: Secure Boot Lab Next: PCR Guide (kernel updates) Updated: 2026-07-24
Contents
  1. Before you start
  2. 1. BIOS/firmware baseline
  3. 2. Install Debian with LUKS2
  4. 3. Enable Secure Boot
  5. 4. Install Clevis
  6. 5. Find the LUKS partition
  7. 6. Bind to TPM2
  8. 7. Verify
  9. What's next

Before you start

What you'll have at the end: Debian booting with Secure Boot enabled, the root filesystem on LUKS2, and the TPM automatically releasing the unlock key on a normal boot — with a human passphrase slot kept as the recovery path.

This page deliberately skips MOK/DKMS enrollment, UKIs, IMA, and the systemd-cryptenroll alternative. If you need any of those, go to the full Secure Boot Lab instead — sections 5, 6, 10, and 13.

1. BIOS/firmware baseline

Enter BIOS setup and confirm:

  • Boot mode: UEFI only (Legacy/CSM disabled).
  • Secure Boot: enabled, with the Microsoft UEFI CA key enabled.
  • TPM: present and enabled. Do not clear it.
  • Storage controller: standard NVMe/AHCI exposure (no RAID/RST mode).

Full rationale and the complete settings table: Secure Boot Lab §2.

2. Install Debian with LUKS2

  1. Boot the Debian installer in UEFI mode.
  2. If the installer fights with Secure Boot, disable it temporarily for install only.
  3. Choose guided encrypted LVM (or manually create a LUKS2 container with LVM inside).
  4. EFI System Partition mounted at /boot/efi; a separate unencrypted /boot.
  5. Set a strong LUKS passphrase — this is your recovery path. Keep it.
  6. Finish installation and boot into Debian.

Confirm LUKS2 after first boot

lsblk -o NAME,PATH,TYPE,FSTYPE,FSVER,SIZE,MOUNTPOINTS,UUID
export DEV=/dev/nvme0n1p3   # adjust to your crypto_LUKS partition
sudo cryptsetup luksDump "$DEV" | head -5

You want to see Version: 2, not Version: 1.

3. Enable Secure Boot

sudo apt update
sudo apt install shim-signed grub-efi-amd64-signed mokutil
sudo update-grub
sudo grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=debian --recheck
mokutil --sb-state

Expect: SecureBoot enabled.

4. Install Clevis

Install all five packages together. The bare clevis package alone does not provide clevis luks ... — that's a separate package, and the TPM2 pin is another. Skipping either one now means clevis luks list fails later with a confusing "invalid command" error instead of a clear "not installed" message. 
sudo apt update
sudo apt install clevis clevis-luks clevis-tpm2 clevis-initramfs tpm2-tools

Confirm the TPM2 pin actually works

ls -l /dev/tpmrm0 /dev/tpm0 2>/dev/null
echo test | clevis encrypt tpm2 '{}' >/dev/null && echo "TPM2 pin OK"

If that prints 'tpm2' is not a valid pin! instead of TPM2 pin OK, clevis-tpm2 did not install correctly — reinstall it before continuing.

5. Find the LUKS partition

lsblk -o NAME,PATH,TYPE,FSTYPE,FSVER,SIZE,MOUNTPOINTS,UUID
export DEV=/dev/nvme0n1p3   # the parent partition with FSTYPE=crypto_LUKS
Do not target the EFI System Partition, /boot, /dev/mapper/vg-root, or a mount point like /. The correct target is the crypto_LUKS partition itself, one level below the physical disk. Full disambiguation table: Secure Boot Lab §8.

6. Bind to TPM2

Start with PCR 7 only. It binds unlock to Secure Boot policy without dragging in firmware/device/initramfs measurements that are likely to shift during ordinary maintenance — the safest starting policy, and the one this guide's companion kernel update procedure assumes you're running. 

sudo clevis luks bind -y -d "$DEV" tpm2 '{"pcr_bank":"sha256","pcr_ids":"7"}'
sudo update-initramfs -u -k all
sudo clevis luks list -d "$DEV"

The list output should now show one tpm2 slot. Do not remove the passphrase slot you set during install — Clevis adds an unlock method, it does not replace the human recovery path.

7. Verify

  1. Cold boot. Confirm no disk passphrase prompt.
  2. Cold boot a second time. Confirm no prompt.
  3. Warm reboot. Confirm no prompt.
  4. Confirm the passphrase still works: sudo cryptsetup open --test-passphrase "$DEV"

If any boot prompts for the passphrase, see Secure Boot Lab §15.

What's next

  • Doing a kernel update? Use the PCR Guide — it assumes exactly the PCR-7 baseline this page just created.
  • Want the moderate (PCR 4,7) or strict 8-PCR policy once the system has settled? See Secure Boot Lab §9.
  • Need MOK/DKMS signing, UKIs, IMA, or systemd-cryptenroll instead of Clevis? See the full Secure Boot Lab.