2399488_en-US

[#1]

Is it possible to reprovision the i.MX93 board?

I have already provisioned my FRDM i.MX93 board using EdgeLock 2GO, and the provisioning completed successfully.Now I would like to reprovision the same board with a new or updated set of secure objects, such as a key pair and X.509 certificate.Is reprovisioning supported on an already provisioned i.MX93 device?If yes, could you please clarify the recommended procedure? Specifically, do the previously provisioned secure objects need to be deleted or reset before provisioning again, or can they be updated through EdgeLock 2GO?Also, are there any restrictions or irreversible settings that I should be aware of before attempting reprovisioning?

The logs:--

ERROR: iot_agent_utils_create_self_signed_edgelock2go_certificate L#1035 mbedtls_pk_setup_opaque failed: 0xffffc180
ERROR: iot_agent_utils_write_edgelock2go_datastore L#1150 iot_agent_utils_create_self_signed_edgelock2go_certificate failed: 0xffffffff
ERROR: iot_agent_utils_create_self_signed_edgelock2go_certificate L#1035 mbedtls_pk_setup_opaque failed: 0xffffc180
ERROR: iot_agent_utils_write_edgelock2go_datastore L#1150 iot_agent_utils_create_self_signed_edgelock2go_certificate failed: 0xffffffff
ERROR: iot_agent_utils_create_self_signed_edgelock2go_certificate L#1035 mbedtls_pk_setup_opaque failed: 0xffffc180
ERROR: iot_agent_update_device_configuration_from_constants L#614 iot_agent_utils_create_self_signed_edgelock2go_certificate failed: 0xffffffff
ERROR: iot_agent_update_device_configuration L#657 iot_agent_update_device_configuration_from_constants failed with 0xffffffff
Status(oem-prov-app): FAILURE

FRDM-TrainingHands-On TrainingSecurityYocto ProjectRe: Is it possible to reprovision the i.MX93 board?

Hello,

It is possible to reprovision, EdgeLock 2GO is designed for full lifecycle management, including updating, rotating, or revoking certificates and keys after initial deployment.

Could you please share which steps did you follow for secure provisioning?

You need to be aware of procedures that involves burned configurations in fuses such as keys, life cycle, etc.

Best regards.

Re: Is it possible to reprovision the i.MX93 board?

Thanks for confirming reprovisioning is supported at the service level. To clarify: this isn't a fresh provisioning attempt — it's a reprovisioning attempt on a board that already provisioned successfully once (lifecycle OEM_OPEN, ELE firmware 2.0.5-7a34cee, with a key and certificate object already present from the first pass).

On this second pass, oem-prov-app fails inside iot_agent_update_device_configuration_from_constants() → iot_agent_utils_create_self_signed_edgelock2go_certificate(), at the mbedtls_pk_setup_opaque() call, returning MBEDTLS_ERR_PK_BAD_INPUT_DATA (0xffffc180). Versions: el2go-agent 6.4.2-r0, smw 5.3-r0, mbedtls 3.6.5-r0.

Two questions:

1.Does reprovisioning require explicitly erasing the existing key object (via psa_destroy_key or the SMW key-storage API) before rerunning oem-prov-app, or should the agent overwrite it in place at the same key ID? We're currently not doing any explicit erase step.
2.Is there a known compatibility issue between el2go-agent 6.4.2-r0 and smw 5.3-r0 specifically on the reprovisioning/update path — since we saw this same error during initial bring-up too, and suspected a version mismatch there as well?

Also — can you confirm the provisioned key and cert objects live in ELE-managed NVM rather than fuses, so a failed reprovisioning attempt doesn't leave that key ID permanently unusable?

Re: Is it possible to reprovision the i.MX93 board?

Hello,

Thank you for the information.

1. Yes, perform a key store reprovisioning using a signed message. A key store re-provisioning results in erasing all the key stores handled by the HSM.

2. No, there are no compatibility issues reported.

3. That is correct, application keys and certificates are stored in ELE-managed NVM, not in fuses.

Best regards.