CST(1)

✨ cst(1) — the Code Signing Tool glow-up ✨

okay so bestie, welcome to cst(1), straight out of the i.MX CST Documentation 💖 this is the whole vibe and I'm gonna walk you through it, no gatekeeping.

---

🌸 NAME 🌸

cst — the Code Signing Tool for generating binary CSF files for NXP secure boot. she makes the signature files, that's her whole job, periodt 💅

---

🎀 SYNOPSIS 🎀

cst --output file --input file [--cert cert.pem] [--backend ssl|pkcs11]
[--verbose]

cst --license|--version|--help

like, either you're signing something, or you're just asking her questions. both are valid 🫶

---

🦋 NOTE 🦋

heads up bestie: this manpage is just a short description of NXP cst. for the full deep dive you gotta go read the Code Signing Tool User Guide UG10106, section 5. you can get that user guide from www.nxp.com — it's excluded from Debian for copyright reasons, so it's not living in your package, ngl. 😭

---

👑 DESCRIPTION 👑

cst (Code Signing Tool) is the icon, the moment, the main character. she generates a binary Command Sequence File (CSF) — which is exactly what the HAB or AHAB secure boot mechanisms on NXP i.MX processors need. the CSF is the whole point: it holds the authentication commands and signature data used to verify signed boot images during the secure boot process. verification rep, fr fr ✨

here's the flow: the tool takes a plain-text CSF description file and produces a binary CSF that can be appended to or embedded in a boot image. and optionally, you can hand her a certificate so she encrypts the Data Encryption Key (DEK). cute, encrypted, protected 💜

also, she pulls general settings, plus the settings related to discovering the PKCS#11 module, out of the system wide OpenSSL configuration file. so those get loaded from the system config, not invented out of thin air. iykyk 🌈

---

✨ OPTIONS ✨

• -o, --output file — the output binary CSF file to generate. this is what you're making, bestie.
• -i, --input file — the input CSF description text file. this is what you're reading.
• -c, --cert cert.pem — public key certificate to encrypt the DEK. optional! 🎀
• -b, --backend backend — optional. the backend for key handling. default is ssl (local filesystem). pkcs11 uses a PKCS#11-compatible keystore. pick your fighter 🦋
• -g, --verbose — enable verbose output. she'll tell you everything she's doing, oversharing era 💅
• -l, --license — print license information and exit. bye bestie 👋
• -v, --version — print the tool version and exit.
• -h, --help — display a brief help message. when in doubt, ask for help, that's growth 🌱

---

🔥 EXAMPLES 🔥

generate binary CSF from a text CSF file:

cst -o out_csf.bin -i hab4.csf

encrypt DEK with a certificate:

cst -o out_csf.bin -c cert.pem -i hab4.csf

look at that. two commands, one slay. ✨

---

🌈 SEE ALSO 🌈

srktool(1), hab_csf_parser(1), config(5ssl) — go read those too, they're in the group chat 💖

---

and that's the whole page bestie!! stay signed, stay secure, and remember — this one shipped in the i.MX CST Documentation and it's dated 2026-09-02. love that for us. mwah 💅💖✨