HABv4 Handling of Certificates

[rnicolls]

Hi,

When creating a certificates for authenticating with the HABv4, does the expiry data matter? Will the HABv4 check the expiry data and prevent the device from booting up? Or will the device continue to bootup and run the code?

Also, will it matter for the tools that are signing the image that we're programming onto our device. Will they refuse to sign once the certificate has expired?

We're working with an IMXRT1176.

Thanks,

Rory

[Bio_TICFSL]

Hello,

The expiry date in certificates used for HABv4 authentication does not impact the device's ability to boot. The Hardware Authenticated Boot (HAB) on i.MX RT processors, including your IMXRT1176, does not verify certificate expiration dates during the boot process. This means that:

1. A signed image will continue to boot on a closed (locked) device regardless of whether the certificate has expired.

2. Your device will not be prevented from booting up due to an expired certificate.

3. The duration value entered during PKI tree generation (with hab4_pki_tree.sh) is required by the X.509 standard but is not enforced by the HAB hardware.

As for the signing tools, they may refuse to sign new images once the certificate has expired, but this only affects the host PC running the Code Signing Tool (CST), not the target device itself. If you plan to continue signing images for an extended period, you can set a longer duration (such as 10-20 years) when generating your PKI tree.

This behavior is consistent across the i.MX RT series and other i.MX processors that use HABv4.

Regards