Secure boot IMX8M keys and certs maintainance

[srinu_inaganti1]

Hi Team,

As most of you know, we use the NXP CST (Code Signing Tool) to generate the keys and certificates required for secure booting on i.MX8M series processors. However, I would like some clarification and insights on how keys and certificates are managed in production systems, especially over the long life cycle of embedded devices.

Here are my questions:

1. When using the CST tool, we specify a validity period for the keys and certificates (e.g., 10 years). However, most embedded devices have a life expectancy of 15-20 years, sometimes even longer. How do we handle key and certificate updates once they expire?

2. Once the keys or certificates expire, does secure booting stop working, or is there a way to maintain the system's security without interrupting secure boot?

3. Since the OTP (One-Time Programmable) memory can only be programmed once, how can we update the keys and certificates without reprogramming the OTP? Is there a method for handling updates securely after OTP programming?

4. What is the best way to manage secure boot infrastructure for Linux-based embedded systems using i.MX8M processors, ensuring long-term security and functionality without key expiration issues?

Any advice or best practices on how to manage keys, certificates, and secure booting over the long term for embedded systems would be highly appreciated.

Thank you in advance for your help!