Hello Igor,
In my application, I have an i.MX25 series of processors and in that the secure boot of the device is implemented using the High Assurance Boot version 3 i.e. HABv3 using NXP's Code Signing Tool (CST v3.1.0).
For this, we have to generate one PKI tree using hab3_pki_tree.sh script (comes with CST tool binaries) which creates certificates and private keys. Previously the generation of the PKI tree is done on a local PC so we have no issues with hab3_pki_tree.sh script, it is generating the PKI tree for us and later we generate the CSF source files and put the certificates inside the device.
But now we are using Utimaco's HSM module to securely generate the keys hence now the keys are not present on the local PC instead the keys are present inside the HSM module.
Now, there is a step in hab3_pki_tree.sh script where we need to convert the generated X509 certificates into WTLS format, for this NXP has provided a tool i.e. x5092wtls with the CST v3.1.0 binary. But this tool won't be able to access the private keys from HSM as it didn't support either the OpenSSL or PKCS#11 engine.
I need a solution so that this x5092wtls tool can access the keys from HSM and convert the X509 format certificates into WTLS format. Hence, either NXP will provide a solution for this or NXP can share the source code of the x5092wtls tool and I can modify it as per my need.
Thanks and Regards
Ashish Bhatnagar
