The man page of tpm2_createak is wrong. It should be: tpm2_createek -c ek.handle -G rsa -u ek.pub tpm2_createak -C ek.handle -c ak.ctx -u ak.pub -n ak.name tpm2_evictcontrol -C o -c ak.ctx 0x81010002 I was having the same problem, and that worked for me!