Clear FDO device credentials

To decommission a device, repurpose it for a new environment, or troubleshoot failed onboarding attempts, clear the FDO device credentials.

Before you begin

  • You have root privileges.
  • Optional: For TPM-based clearing, you installed the tpm2-tools package.
  • All active onboarding processes are stopped.

About this task

By removing the FDO device credentials, you reset the device’s identity, ensuring that sensitive ownership metadata is cleared and the device is ready to be re-initialized from a clean state.

Procedure

Clear the credential by using the method appropriate for your storage type:
  • For a file-based credential:

    Delete the credential blob from the /boot directory or the specific location defined during initialization.

    $ sudo rm /boot/device_credential
  • For a TPM-backed credential:

    If the credential is stored in the Trusted Platform Module (TPM) non-volatile (NV) memory, release the specific index, which is typically 0x01D10001 for FDO.

    $ sudo tpm2_nvundefine 0x01D10001

Results

  • Run the print command. The command fails and returns a file not found or NV index not defined error, which confirms that the credential is cleared.