HAB4_PKI_TREE(1)

💖 HAB4_PKI_TREE(1) 💖

okay bestie, so welcome to the HAB4_PKI_TREE(1) page from the i.MX CST Documentation — that's the i.MX Code Signing Tool doc, and this one's all about building a PKI tree so your NXP i.MX processor can do secure boot. grab a strawberry 🍓, we're doing crypto.

---

✨ NAME ✨

ahab_pki_tree, hab4_pki_tree — generate a basic PKI tree for secure boot on NXP i.MX processors

fr fr, that's the whole job. two little tools, one big vibe. 👑

---

🎀 SYNOPSIS 🎀

AHAB

ahab_pki_tree -existing-ca yn [-ca-key name -ca-cert name] -kt algo
-kl param -duration years -num-srk nr -srk-ca yn [--help]

HABv4

hab4_pki_tree -existing-ca yn [-ca-key name -ca-cert name] -kt algo
-kl param -duration years -num-srk nr -srk-ca yn [--help]

they're siblings, they take the same flags, they just live in slightly different eras. 💅

---

🦋 NOTE 🦋

so this manpage is literally just a short description of NXP's ahab_pki_tree and hab4_pki_tree. if you want the full deep-dive, you gotta go read the Code Signing Tool User Guide UG10106, section 4.1.1.

heads up: that user guide lives over at www.nxp.com and is excluded from Debian for copyright reasons — so it's not gonna be sitting in your package, bestie. you'll have to go get it yourself. 😭

---

🌸 DESCRIPTION 🌸

ahab_pki_tree and hab4_pki_tree generate a basic PKI tree. and what's in that tree, you ask? a Certificate Authority (CA) and one or more Super Root Keys (SRK). iconic. 🫶

here's where the two variants get their own personality:

• with the ahab variant, each SRK has one subordinate Signing Key (SGK).
• the hab4 variant creates one subordinate Command Sequence File (CSF) key and one image (IMG) key for each SRK.

and ngl, you're not locked in — additional keys can later be added with the add_key tool. slay, expandable. ✨

the following files and directories are expected relative to the current working directory, or they get created if they don't exist yet:

• crts — the directory where X.509 public key certificates for CA, SRK, SGK, CSF and IMG are searched for and created. all certificates are in PEM and DER format. the naming convention is name.pem, where name refers to the argument you supplied with -ca-cert name and -ca-key name.
• keys — the directory where the private keys corresponding to the certificates in crts are searched for and created. all keys are in PKCS #8 syntax and are encoded to PEM and DER format.
• keys/key_pass.txt — a text file holding a password to protect your private keys. the password is repeated twice, like this:

my_password
my_password

the same password is used for all private keys. and the default password is "test" — yes, really, test. don't leave it like that, I'm begging. 🙈

also, both tools will load general settings from the system wide OpenSSL configuration file. noted. 📝

---

💅 OPTIONS 💅

every flag, one by one, no skipping, we stay thorough:

• -existing-ca yn — set it to y to use an existing CA key, or n to generate the CA key and certificate from scratch. if you went with y, then the -ca-key and -ca-cert options are mandatory — no dodging them.
• -ca-key name — if -existing-ca was y, this specifies the existing CA key.
• -ca-cert name — if -existing-ca was y, this specifies the existing CA certificate.
• -kt algo — the public key algorithm to use. pick one of rsa, rsa-pss, ecc.
• -kl param — the key length-ish parameter, and what's valid depends on your algo:
  • for algo ecc, one of p256, p384, p521.
  • for algo rsa and rsa-pss, one of 2048, 3072, 4096.
• -duration years — the validity period of the PKI tree in years.
• -num-srk nr — how many SRKs to generate. must be between 1 and 4. that's the range, no cap beyond that. (well, the cap is 4. that's the cap.) 💀
• -srk-ca yn — set it to:
  • y to generate SRK certificates with the CA flag set. such SRK certificates can be used to issue other certificates. main character energy. 👑
  • n to generate user certificates.
• --help — print help text. the classic. whenever you're lost, just ask. 🌈

---

🔥 EXAMPLES 🔥

wanna generate a HAB4 PKI tree with two SRKs? bet. here's the exact line:

hab4_pki_tree -existing-ca n -kt rsa -kl 4096 -duration 5 -num-srk 2 -srk-ca y

copy it, paste it, go secure some boot. periodt. 💖

---

⭐ SEE ALSO ⭐

go peek at these when you're done here, they're the friend group:

add_key(1), cst(1), srktool(1), config(5ssl)

---

okay that's the whole page bestie, you ate. 🍓✨ this was the i.MX CST Documentation version of HAB4_PKI_TREE(1), dated 2026-09-02 — go forth and build your tree, ily, bye! 💜🦋🌸