Arch Linux

RhabSnaks

Member

Registered: 2026-09-27

Posts: 1

[SOLVED]PCR policies issue

Hello! On a freshly installed arch linux system (UKI+LUKS2 with TPM2+Secure boot) , installed following this wiki page, systemctl --failed output goes like this:

  UNIT                             LOAD   ACTIVE SUB    DESCRIPTION                                      
● systemd-pcrlogin@1000.service    loaded failed failed TPM NvPCR Measurement of User Record for UID 1000
● systemd-pcrlogin@945.service     loaded failed failed TPM NvPCR Measurement of User Record for UID 945
● systemd-pcrproduct.service       loaded failed failed TPM NvPCR Product ID Measurement
● systemd-tpm2-setup-early.service loaded failed failed Early TPM SRK Setup

While system loads normally (including unlocking the LUKS volume with TPM).
Trying to fix these errors, following this wiki page doesn't succeed, since the ukify genkey part uses the

tpm2-pcr-public-key.pem

filename, while the systemd-cryptenroll part uses the

tpm2-pcr-public-key-initrd.pem

filename. The names are different, so systemd-cryptenroll can't find the public key.
Replacing the public key filename with one generated in the ukify genkey step or changing /etc/kernel/ukify.conf to:

[UKI]
SignKernel=false
Splash=/usr/share/systemd/bootctl/splash-arch.bmp
SignInitrdPCRs=yes

[PCRSignature:initrd]
Phases=enter-initrd
PCRPrivateKey=/etc/systemd/tpm2-pcr-private-key-initrd.pem
PCRPublicKey=/etc/systemd/tpm2-pcr-public-key-initrd.pem

(Signing files for secure boot is handled by sbctl)
and running ukify genkey based on the config leads to the same result - two of the errors disappear, and systemctl --failed now returns

   UNIT                             LOAD   ACTIVE SUB    DESCRIPTION                     
● systemd-pcrproduct.service       loaded failed failed TPM NvPCR Product ID Measurement
● systemd-tpm2-setup-early.service loaded failed failed Early TPM SRK Setup

How to fix the remaining two errors?

Last edited by RhabSnaks (2026-09-28 16:50:43)

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 78,102

Re: [SOLVED]PCR policies issue

https://bbs.archlinux.org/viewtopic.php?id=314939
https://bbs.archlinux.org/viewtopic.php … 0#p2310650

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc