ADD_KEY(1)

💖 ADD_KEY 💖

okay so hi bestie 🫶 you've found add_key, section 1 of the i.MX CST Documentation. She's a little script with big main character energy and she's here to help you with secure boot on NXP i.MX processors. Let's get into it ✨

---

🎀 NAME 🎀

add_key — adds brand new keys to a PKI tree that already exists, for secure boot on NXP i.MX processors. That's it, that's the job 💅

---

🌸 SYNOPSIS 🌸

Interactive mode (aka the "just vibe and answer the questions" mode):

add_key

Non-interactive mode (aka the "I already know what I want" mode):

add_key -ver hab_version -key-name name -kt algo -kl param [-md algo] -duration years -srk yn [-srk-ca yn] -signing-key name -signing-crt name

---

✨ NOTE ✨

This manpage is a short description of NXP add_key, okay? If you want the full deep dive, go read the Code Signing Tool User Guide UG10106, section 4.1.5. You can grab the user guide from www.nxp.com — it's not in Debian for copyright reasons, so no, it's not hiding in your package manager, bestie 😭

---

🦋 DESCRIPTION 🦋

add_key adds an SRK or a CSF/IMG/SGK key to a PKI tree that already exists — meaning one you already made earlier with ahab_pki_tree or hab4_pki_tree, sitting there in the crts and keys sub directories.

Those directories are expected to be in the current working directory. So like, don't be surprised when she goes looking right where you're standing 👀

And if you pass her no arguments at all? She flips into interactive mode and starts prompting you for options, one by one, like a very organized bestie with a clipboard 📋

---

💅 OPTIONS 💅

• -ver hab_version — which HAB version your PKI tree is. Pick 4 for HAB4, or a for AHAB. Those are your two options, periodt.
• -key-name name — the name of the key you want generated. Name her something cute 💖
• -kt algo — the public key algorithm to use. One of rsa, rsa-pss, ecc.
• -kl param — depends on your algo, bestie:
  • for algo ecc, pick one of p256, p384, p521.
  • for algo rsa and rsa-pss, this is the key length in bits. One of 2048, 3072, 4096.
• -md algo — the hash function to use.
  • This one is only valid for hab_version a, and it can be one of sha256, sha384, sha512.
  • For hab_version 4, the hash function is fixed to sha256 — not up for debate, she said what she said.
• -duration years — how long the generated certificate stays valid, in years. Clock's ticking ⏳
• -srk yn — y to generate a new SRK key, or n to generate a CSF/IMG/SGK key.
• -srk-ca yn — y to generate SRK certificates where the CA flag is set. Those SRK certificates can be used to issue other certificates, like a queen handing out crowns 👑
  • n to generate user certificates.
• -signing-key file — path to an existing signing key, in PEM or DER encoding. And listen: if -srk was y, this file must specify the CA key. If -srk was n, this file must specify the SRK. No mixing those up 🙈
• -signing-cert file — path to an existing signing certificate. Same rule applies: if -srk was y, this file must specify the CA certificate. If -srk was n, this file must specify the SRK certificate.
• --help — prints the help text. The classic 💀

---

🔥 EXAMPLES 🔥

First up, your starting point: generate a PKI tree with two SRKs. Do this in a directory where the current user has write permissions, okay? She cannot work her magic in a read-only situation, ngl.

hab4_pki_tree -existing-ca n -kt rsa -kl 4096 -duration 5 -num-srk 2 -srk-ca y

Then, to add a new SRK to the PKI tree:

add_key -ver 4 -key-name SRK3 -kt rsa -kl 4096 -duration 5 -srk y -srk-ca y -signing-key keys/CA1_sha256_4096_65537_v3_ca_key.pem -signing-crt crts/CA1_sha256_4096_65537_v3_ca_crt.pem

Look at her go. Ate and left no crumbs 🍓

---

🌈 SEE ALSO 🌈

hab4_pki_tree(1), ahab_pki_tree(1) — her two besties, go say hi 🫶

---

and that's the whole page, bestie 💜 this was page ADD_KEY(1) from the i.MX CST Documentation, dated 2026-09-02 — screenshot it, cite it, print it out and put it on your wall, iykyk ✨🎀🦋