(7/30/26 Draft Version) Certificate Store

Secured	File Type	File Type Version	File Subtype	File Index	Remark
Get: N/A Set: No	0x0A	0x00	0x00	0x00	Subtype 0=VICAL File (>= 20 certificates, Max 30), File Index is 0x00.
Get: N/A Set: Yes	0x0A	0x00	0x01	0x00–0x0E	Subtype 1=Certificates, provided by DMVs, Apple, Google, etc. Max 15 files.
Get: No Set: N/A	0x0A	0x00	0x02	0x00	Subtype 2=Cert Store Table

Send File

• 0xD811 (Secured)

• 0xD812 (Unsecured)

Host App may send the following files to the device:

a)       File ID:0A-00-00-00                          // VICAL file
b)       File ID:0A-00-01-00 to 0A-00-01-0E           // Individual files

Fetch File

• 0xD821

Host App may fetch the following files from the device:

a)       File ID:0A-00-02-00                         // CERT Store Table

Delete File

• 0xD831

Host App may delete the following files from the device:

a)       File ID:0A-00-00-00                // VICAL file
b)       File ID:0A-00-01-00 to 0A-00-01-0E // Individual files
c)       File ID:0A-00-02-00                // CERT Store Table

NOTE 1: If users delete the VICAL file (0A-00-00-00), then FW will delete all the VICAL certificates.

NOTE 2: If users delete the CERT Store Table file (0A-00-02-00), then FW will delete all the certificates.

Example: 0xD831 command string to delete CERT Store Table

For AB4.10 & older images: Use File ID: 0A-00-01-00

For AB4.11 & newer images: Use File ID: 0A-00-02-00

AA0081040105D8318408D83181040A000100 // for AB4.10 & older images

AA 00 // Header

81 04 01 05 D8 31 // P1, 0xD831 Command, Msg ID 05

84 08 D8 31 // P4, Len=8

81 04 0A 00 01 00 // P4->P1, File ID=0x0A000100

Script file to load certificate to unit

Example #1

Write vical_4_2_2026.cbor as File ID: 0A-00-00-00 to the unit Unsecured (0xD812)

The subtype 0x00 VICAL certificates will be loaded into the unit, starts from entry #00 to #29.

SendFile00 = data:{$SendFile(0A000000,$LoadFile(C:\Doc\mDL\Cert-Loading\certs\ vical_4_2_2026.cbor))}

Example #2

Write file_00.der as File ID: 0A-00-01-00 to the unit Secured (0xD811)

The subtype 0x01 individual certificates will be loaded into the unit, starts from entry #30 to #44.

SendFile1E = data:{$SendFile(0A000100,$LoadFile(C:\Doc\mDL\Cert-Loading\certs\file_00.der),MAC)}

The data structures of CERT_STORE_T

The size of an entry (CERT_REC_T) is 32 bytes, so the entire store (CERT_STORE_T) has 32x45 = 1440 bytes.

typedef struct
{
    uint16_t year;
    uint16_t mon;
    uint8_t  day;
    uint8_t  hour;
    uint8_t  min;
    uint8_t  sec;
} MDL_CERT_TIME;

typedef struct                  // 32 bytes total
{
    uint8_t  status[2];          // ACTIVE or empty
    uint8_t  ski[8];             // subject key identifier
    uint8_t  region[6];          // example: US-CA
    MDL_CERT_TIME from_time;     // not before time in RTC format
    MDL_CERT_TIME to_time;       // not after time in RTC format
} CERT_REC_T;

#define CERT_STORE_MAX_CNT       45      // the max number of entries in CERT Store

typedef struct
{
    CERT_REC_T entry[CERT_STORE_MAX_CNT];
} CERT_STORE_T;

Host Application may fetch the file of “Certificate Store Table” with File ID:0A-00-02-00. Then, decode and display the contents of the file as follows: (4 certificates in this case)

Scanning input file: cert_table.bin.

• The input file size = 1440 bytes.

• Data Structure & File Size match.

CERT Store Operation Table[45] =

--Index:  00     Region: US-MD
  Status: 01-00  SKI: 4E9AD1CDA1412754
  FROM: 2024-01-05 05:00:00  TO: 2029-01-04 05:00:00

--Index:  01     Region: US-UT
  Status: 01-00  SKI: 3C4C6CDFE782342E
  FROM: 2023-12-18 12:25:47  TO: 2032-12-15 12:25:46

--Index:  03     Region: US-VA
  Status: 01-00  SKI: 9614BCEB5DD9FBBB
  FROM: 2025-07-22 13:26:02  TO: 2027-07-22 13:26:01

--Index:  26     Region: US-CA
  Status: 01-00  SKI: BB7D7567927A6FCF
  FROM: 2023-03-01 17:17:39  TO: 2033-01-07 17:17:39