HAB4_PKI_TREE(1)

NAME
ahab_pki_tree, hab4_pki_tree - generate a basic PKI tree for secure boot on NXP i.MX processors

SYNOPSIS

AHAB
    ahab_pki_tree -existing-ca yn [-ca-key name -ca-cert name] -kt algo -kl param -duration years -num-srk nr -srk-ca yn [--help]

HABv4
    hab4_pki_tree -existing-ca yn [-ca-key name -ca-cert name] -kt algo -kl param -duration years -num-srk nr -srk-ca yn [--help]

NOTE
This manpage is a short description of NXP ahab_pki_tree and hab4_pki_tree. For a detailed discussion refer to the Code Signing Tool User Guide UG10106, section 4.1.1. The user guide can be obtained from www.nxp.com and is excluded from Debian for copyright reasons.

DESCRIPTION
ahab_pki_tree and hab4_pki_tree generate a basic PKI tree. The PKI tree consists of a Certificate Authority (CA) and one or more Super Root Keys (SRK). With the ahab variant, each SRK has one subordinate Signing Key (SGK). The hab4 variant creates one subordinate Command Sequence File (CSF) key and one image (IMG) key for each SRK. Additional keys can later be added with the add_key tool.

Following files and directories relative to the current working directory are expected or are created if not existing.

crts
    Directory where X.509 public key certificates for CA, SRK, SGK, CSF and IMG are searched and created. All certificates are in PEM and DER format.

    The naming convention is name.pem, where name refers to the argument supplied with -ca-cert name and -ca-key name.

keys
    Directory where private keys corresponding to the certificates in crts are searched and created. All keys are in PKCS #8 syntax and are encoded to PEM and DER format.

keys/key_pass.txt
    Text file containing a password to protect private keys. The password is repeated twice, for example

      my_password
      my_password

    The same password is used for all private keys. Default password is "test".

The tools will load general settings from the system wide OpenSSL configuration file.

OPTIONS

-existing-ca yn
    y to use an existing CA key, or n to generate CA key and certificate from scratch. If y, the -ca-key and -ca-cert options must be specified.

-ca-key name
    If -existing-ca was y, this option specifies the existing CA key.

-ca-cert name
    If -existing-ca was y, this option specifies the existing CA certificate.

-kt algo
    Public key algorithm to use. One of rsa, rsa-pss, ecc.

-kl param
    For algo ecc, one of p256, p384, p521.

    For algo rsa and rsa-pss, one of 2048, 3072, 4096.

-duration years
    Validity period of the PKI tree in years.

-num-srk nr
    Number of SRKs to generate. Must be between 1 and 4.

-srk-ca yn
    y to generate SRK certificates with the CA flag set. Such SRK certificates can be used to issue other certificates.

    n to generate user certificates.

--help
    Print help text.

EXAMPLES
To generate a HAB4 PKI tree with two SRKs

  hab4_pki_tree -existing-ca n -kt rsa -kl 4096 -duration 5 -num-srk 2 -srk-ca y

SEE ALSO
add_key(1), cst(1), srktool(1), config(5ssl)