Other NXP ProductsのトピックRe: can we use provisioned cert or key for setting up in the https connection or tls connection in i

can we use provisioned cert or key for setting up in the https connection or tls connection in i.mx9

NEXUSNERD — Mon, 20 Jul 2026 08:58:52 GMT

Can the provisioned certificate and private key on the i.MX93 be used directly to establish HTTPS/TLS connections? If yes, what is the recommended method for accessing and utilizing these credentials for client/server authentication and mTLS implementations?

once provisioning is complete and the secure object blobs are present in /etc/ele/, what is the recommended workflow for using those provisioned credentials in a real HTTPS/TLS connection?

Re: can we use provisioned cert or key for setting up in the https connection or tls connection in i

Manuel_Salas — Mon, 20 Jul 2026 16:44:13 GMT

Hello @NEXUSNERD

Hope you are doing very well.

On the i.MX93, the provisioning flow is designed so that the private key remains protected by the ELE.

So, the blobs stored in /etc/ele/ are secure object representations that allow ELE to reload or reference the provisioned key material, and they are not intended to be treated as ordinary TLS key files.

You can take a look to the imx-secure-enclave (Mbed-TLS).

Best regards,

Salas.

Re: can we use provisioned cert or key for setting up in the https connection or tls connection in i

NEXUSNERD — Tue, 21 Jul 2026 05:41:47 GMT

Hi ,@Manuel_Salas

Thanks for your reply.
Following up on the mbedTLS/opaque-key guidance — that's resolved on our side for the private key.

Remaining question is specifically about the certificate, provisioned via EL2GO and stored in /etc/ele/ alongside the private key . Since a certificate is public data, we need to extract it as plain DER to hand to mbedtls_x509_crt_parse_der() for the TLS handshake — unlike the key, it doesn't need to stay opaque.

What is the supported SMW/PSA call to retrieve the plaintext DER bytes for a provisioned certificate object?

Specifically: is it exposed via psa_ps_get() / psa_its_get() (PSA Protected Storage / Internal Trusted Storage) using the object ID as the UID, or through a different SMW API? We see protected_storage.h and internal_trusted_storage.h in the installed SMW headers but want to confirm this is the intended path for certificate objects before building against it.