NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
Verify Signature
Sign
A5000 device name
A5000 device
certificate
A5000 public key
NXP Issuer‘s (CA) name
NXP Issuer‘s (CA) signature
A5000 device private key
NXP Intermediate
certificate
NXP Issuer‘s name
NXP Issuer‘s public key
NXP Root CA‘s name
NXP Root CA signature
NXP Issuer‘s private key
NXP Root CA‘s name
NXP Root
certificate
NXP Root CA‘s public key
NXP Root CA‘s signature
NXP Root CA private key
Sign
Verify Signature
Reference
Reference
Self-Sign
Figure 24. Certification chain of the pre-provisioned A5000 device certificates
All pre-provisioned A5000 device certificates are signed with the associated private key
of the NXP intermediate certificate. To verify the validity of the pre-provisined device
certificates we need to download the intermediate certificate.
The NXP intermediate certificate can be downloaded via the following link:
www.gp-ca.nxp.com/CA/getCA?caid=63709315060022
.
The Linux command wegt can be used to download the NXP intermediate certificate. The
-O parameter is used to specify the filename.
wget https://www.gp-ca.nxp.com/CA/getCA?caid=63709315060022 -O
nxp_a5000_intermediate_ca.crt
Figure 25. Download the NXP intermediate certificate
The file
nxp_a5000_intermediate_ca.crt
contains NXP intermediate
certificate in DER format. For the following OpenSSL command-line examples
it is required to convert the certificate into the PEM formatted certification file
(
nxp_a5000_intermediate_ca.pem
). This step can be performed using the following
OpenSSL command:
openssl x509 -in nxp_a5000_intermediate_ca.crt -inform der -out
nxp_a5000_intermediate_ca.pem -outform pem
cat nxp_a5000_intermediate_ca.pem
AN13500
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2022. All rights reserved.
Application note
Rev. 1.0 — 28 March 2022
23 / 45
