CST3.4.0 with HSM

[jbhaijy]

Hi,

I am using latest CST-3.4.0 & I want to explore the CST-3.4.0 with third party HSM. I configured openssl.cnf as like below,

openssl_conf = openssl_init
[openssl_init]
engines = engine_section
[engine_section]
pkcs11 = pkcs11_section
[pkcs11_section]
#Path to the Compiled OpenSSL PKCS11 from OpenSC - libp11
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-1.1/libpkcs11.so
MODULE_PATH = /home/jbhaijy/digicert/smtools-linux-x64/smpkcs11.so

I run the CST with -b pkcs11 option to sign the images through HSM, but I am getting below errors.

./cst --verbose -b pkcs11 -i dev_spl.csf -o dev_spl.bin
Install SRK
Install CSFK
Certificate not found.
Public key certificate is invalid in file pkcs11:model=DigiCert%20PKCS%2311;manufacturer=DigiCert;serial=SS0123456789;token=Virtual%20PKCS%2311%20Token;id=%36%34%33%39%61%63%61%32%2D%35%36%61%30%2D%34%64%64%63%2D%39%36%30%39%2D%65%62%64%39%31%63%36%33%65%33%62%39;object=imx6-hab-csf2-key-test;type=private

Please help me identify the problems here. 

Thanks for you support.  

[mathiyalagan_c]

Hi @jbhaijy  how to get latest cst with hsm, unable to find the latest. 

[jbhaijy]

You can download from https://www.nxp.com/search?keyword=IMX_CST_TOOL
Default this CST tool have HSM support but you need to configure your CSF to get it images signed from HSM. 

Explore the documentation in this tool for further details.

[jbhaijy]

@hector_delgado 

Thank for the reply. 
We want to have CST signing solution for i.MX6 & i.MX8 both. Both are custom boards. I am running Ubuntu-22.04 VM.  

[hector_delgado]

Hi @jbhaijy ,

Have you followed all steps from our Application Note Using Code-Signing Tool with Hardware Security Module (https://www.nxp.com/webapp/Download?colCode=AN12812&location=null)?

Even though it's an old guide, I believe it should still apply to our current CST release.

Let me know if this was of any help.

Best regards,
Hector.

[jbhaijy]

Hi @hector_delgado 

I followed the steps mentioned in the AN12812, Instead of SoftHSM we are using 3rd party HSM. 

What could be the possible reasons?

Regards,

jbhaijy

[roke]

https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/HSM-Code-Signing-Journey/ta-p/1882244

[hector_delgado]

Hi @jbhaijy ,

Could you try the following changes to your openssl.cnf file?

openssl_conf = openssl_def

[openssl_def]
engines = engine_section


[engine_section]
pkcs11 = pkcs11_section


[pkcs11_section]
engine_id = pkcs11
#Path to the Compiled OpenSSL PKCS11 from OpenSC - libp11
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-1.1/libpkcs11.so
MODULE_PATH = /home/jbhaijy/digicert/smtools-linux-x64/smpkcs11.so
init = 0

Let me know if it solves the issue.

Best regards,
Hector.

[hector_delgado]

Hi @jbhaijy ,

I hope you're doing well!

What i.MX are you using? Is it a custom board or one of our EVKs? Also, what distro and version of Linux are you using in your host environment? 

Best regards,
Hector.