Resolving message “Loading jwk to TPM2 failed!”

Question

I'm at my wits' end on this one. A CentOS 7 box with a TPM module.

If I reboot it from the terminal, it seems fine. But if I hard reboot it, it apparently gets stuck in this state, spitting out:

Nov 13 15:17:44 dracut-initqueue: Loading jwk to TPM2 failed!

For two hours, before spitting out:

systemd-cryptsetup: Set cipher aes, mode xts-plain64, key size 512 bits for device /dev/disk/by-uuid/xxx.
Nov 13 15:17:52 kernel: alg: No test for fips(ansi_cprng) (fips_ansi_cprng)
Nov 13 15:17:53 systemd: Found device /dev/mapper/luks-xxx.
Nov 13 15:17:53 systemd: Started Cryptography Setup for luks-xxx.
Nov 13 15:17:53 systemd: Reached target Local Encrypted Volumes.
Nov 13 15:17:53 systemd: Reached target System Initialization.
Nov 13 15:17:53 systemd: Reached target Basic System. 

And then finally loading the OS.

I have no idea what this means.

Answer 1

This might be useful as an introduction of what is (probably) going on: https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-unlocking-using-a-tpm2-chip/

Based on the messages, your system has a LUKS disk encryption configured, apparently using the TPM module as a key store. The messages after the two hours' wait look like normal diagnostic messages from activating an encrypted root filesystem.

The infrastructure between LUKS and the TPM tools may be provided by the clevis package, and that Loading jwk to TPM2 failed! sure looks like a message from clevis.

With quick googling, I found this: https://github.com/latchset/clevis/issues/95

Apparently there is/used to be some kind of an issue that would trigger the rate-limiting feature of the TPM. That makes me think a workaround might be to apply some sort of a delay or a check that the TPM module is fully ready, before initiating the TPM procedures for retrieving/decrypting the disk encryption unlock key.

This might not qualify as a complete Answer, but I hope it at least helps you to understand what might be happening and perhaps give you ideas for further diagnostics.