topic Re: secure boot on imx8m plus on Android14 BSP in i.MX Processors

secure boot on imx8m plus on Android14 BSP

Suryashmichakraborty — Tue, 13 Jan 2026 05:55:48 GMT

I want to enable the secure boot on imx8m plus board with Android 14 BSP, such that the board will always boot on our signed keys only.

Re: secure boot on imx8m plus on Android14 BSP

joanxie — Wed, 14 Jan 2026 03:08:39 GMT

pls refer to this document firstly

https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/Steps-for-single-secure-boot-for-Android-BSP/ta-p/2157256

Re: secure boot on imx8m plus on Android14 BSP

Suryashmichakraborty — Thu, 15 Jan 2026 07:28:32 GMT

I have followed the steps given in the PDF and generated the keys like:

SRK1_sha256_1024_65537_v3_ca_key.der
SRK1_sha256_1024_65537_v3_ca_key.pem
SRK1_sha256_1024_65537_v3_usr_key.der
SRK1_sha256_1024_65537_v3_usr_key.pem
SRK1_sha256_2048_65537_v3_ca_key.der
SRK1_sha256_2048_65537_v3_ca_key.pem
SRK2_sha256_1024_65537_v3_ca_key.der
SRK2_sha256_1024_65537_v3_ca_key.pem
SRK2_sha256_2048_65537_v3_ca_key.der
SRK2_sha256_2048_65537_v3_ca_key.pem
SRK3_sha256_2048_65537_v3_ca_key.der
SRK3_sha256_2048_65537_v3_ca_key.pem
SRK4_sha256_2048_65537_v3_ca_key.der
SRK4_sha256_2048_65537_v3_ca_key.pem and also the CSF, IMG and CA.

the private keys are openssl x509 -in crts/SRK1_sha256_2048_65537_v3_ca_crt.pem -text -noout | grep Subject
Subject: CN = SRK1_sha256_2048_65537_v3_ca
Subject Public Key Info:
X509v3 Subject Key Identifier:

openssl x509 -in crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem -text -noout | grep Issuer
Issuer: CN = SRK1_sha256_2048_65537_v3_ca

openssl rsa -in keys/SRK1_sha256_2048_65537_v3_ca_key.pem -check
Enter pass phrase for keys/SRK1_sha256_2048_65537_v3_ca_key.pem:
RSA key ok

Are all these keys ready to flash on imx8m plus smarc som?

Re: secure boot on imx8m plus on Android14 BSP

joanxie — Tue, 20 Jan 2026 02:10:20 GMT

did you generate SRK table already?

Re: secure boot on imx8m plus on Android14 BSP

Suryashmichakraborty — Wed, 21 Jan 2026 06:50:46 GMT

yes,SRK Hash Table the SRK Hash table is generated successfully from the keys

Re: secure boot on imx8m plus on Android14 BSP

joanxie — Tue, 27 Jan 2026 00:44:04 GMT

ok, then you can refer to the chapter 3.1.2.2 Signing bootloader images and 3.1.2.3 Signing the MCU firmware of enclosed file

Re: secure boot on imx8m plus on Android14 BSP

Suryashmichakraborty — Tue, 03 Feb 2026 11:47:05 GMT

I have burned the fuses on my imx8m plus board, but unable to get the signed image or flashing,

how to recover and find the correct igned image for flashig?

Re: secure boot on imx8m plus on Android14 BSP

Suryashmichakraborty — Mon, 09 Feb 2026 07:19:46 GMT

I am unable to sign the correct image on my imx8m plus board after fusing the keys permanently on the board!