I've read through Application Note 12283 (LPC55Sxx Secure Boot) and am trying to work through exactly how a certificate chain, if it is used, is walked on the processor. My confusion is that the App Note only ever talks about one certificate - the root. It mentions in section 3.4 that you can and should create a certificate chain, but then, how does the ROM validate the chain? Figure 5 (Signed image format) only shows one x509 certificate that would be included in the firmware file. What if my chain has a root -> intermediary -> end entity? Is it expecting that one x509 certificate to include the entire chain in it? If so, are there any length restrictions? This just isn't clear :-(
Also, when generating certificate chains, there is the sequence id that has the revocation id, but each cert in the chain could have their own sequence numbers. What is best practice here? Should all of the sequence numbers in the chain be the same for the purpose of anti-rollback? Or, is only the end entity sequence number checked?
I'm sorry if these questions seem silly, but considering the probability of me bricking my dev kit is high if I make a mistake in this stuff, I'd rather ask silly questions than be left with a paperweight.