@@ -51,6 +51,7 @@ data secure by applying hardware write protection.
5151 - [ Building an example with factory data] ( #building-an-example-with-factory-data )
5252 - [ Providing factory data parameters as a build argument list] ( #providing-factory-data-parameters-as-a-build-argument-list )
5353 - [ Setting factory data parameters using interactive Kconfig interfaces] ( #setting-factory-data-parameters-using-interactive-kconfig-interfaces )
54+ - [ Default Kconfig values and developing aspects] ( #default-kconfig-values-and-developing-aspects )
5455 - [ Programming factory data] ( #programming-factory-data )
5556 - [ Using own factory data implementation] ( #using-own-factory-data-implementation )
5657
@@ -272,6 +273,7 @@ To use this script, complete the following steps:
272273
273274 ```
274275 --chip_cert_path <path to chip-cert executable>
276+ --gen_certs
275277 ```
276278
277279 > **Note:** To generate new certificates, you need the `chip-cert`
@@ -293,7 +295,7 @@ To use this script, complete the following steps:
293295 --rd_uid <rotating device ID unique ID>
294296 ```
295297
296- - Generate a new ID and provide it () :
298+ - (optional) Generate a new ID and provide it:
297299
298300 ```
299301 --generate_rd_uid
@@ -328,6 +330,17 @@ To use this script, complete the following steps:
328330 --product_color <color>
329331 ```
330332
333+ j. (optional) Generate Certification Declaration for testing purposes
334+
335+ ```
336+ --chip_cert_path <path to chip-cert executable>
337+ --gen_cd
338+ ```
339+
340+ > **Note:** To generate new Certification Declaration, you need the
341+ > `chip-cert` executable. See the note at the end of this section to learn
342+ > how to get it.
343+
3313444. Run the script using the prepared list of arguments:
332345
333346 ```
@@ -794,6 +807,55 @@ snippet:
794807> interfaces, read the
795808> [Kconfig documentation](https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/zephyr/build/kconfig/menuconfig.html).
796809
810+ ### Default Kconfig values and developing aspects
811+
812+ Each factory data parameter has its default value reflected in the Kconfig. The
813+ list below shows some Kconfig settings that are configured in the nRF Connect
814+ build system and have an impact on the application. You can modify them to
815+ achieve the desired behavior of your application.
816+
817+ - The device uses the test certificates located in the
818+ `credentials/development/attestation/` directory, which are generated using
819+ all default values. If you want to change the default `vendor_id`,
820+ `product_id`, `vendor_name`, or `device_name` and generate new test
821+ certificates, add the `CONFIG_CHIP_FACTORY_DATA_CERT_SOURCE_GENERATED=y`
822+ Kconfig option. Remember to build the `chip-cert` application and add it to
823+ the system PATH.
824+
825+ For developing a production-ready product, you need to write the
826+ certificates obtained during the certification process. To do this, add the
827+ `CONFIG_CHIP_FACTORY_DATA_CERT_SOURCE_USER=y` Kconfig option and set the
828+ appropriate paths for the following Kconfig options:
829+
830+ - `CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT`
831+ - `CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY`
832+ - `CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT`
833+
834+ - By default, the SPAKE2+ verifier is generated during each example's build.
835+ This means that this value will change automatically if you change any of
836+ the following parameters:
837+
838+ - `CONFIG_CHIP_DEVICE_SPAKE2_PASSCODE`
839+ - `CONFIG_CHIP_DEVICE_SPAKE2_SALT`
840+ - `CONFIG_CHIP_DEVICE_SPAKE2_IT`
841+
842+ You can disable the generation of the SPAKE2+ verifier by setting the
843+ `CONFIG_CHIP_FACTORY_DATA_GENERATE_SPAKE2_VERIFIER=n` Kconfig option. Then,
844+ you will need to provide the externally-generated SPAKE2+ verifier using the
845+ `CONFIG_CHIP_DEVICE_SPAKE2_TEST_VERIFIER` Kconfig value.
846+
847+ - Generating the rotating device ID unique ID is disabled by default, but you
848+ can enable it by setting the `CONFIG_CHIP_ROTATING_DEVICE_ID=y` and
849+ `CONFIG_CHIP_DEVICE_GENERATE_ROTATING_DEVICE_UID=y` Kconfig values.
850+ Moreover, if you set the `CONFIG_CHIP_ROTATING_DEVICE_ID` Kconfig option to
851+ `y` and disable the `CONFIG_CHIP_DEVICE_GENERATE_ROTATING_DEVICE_UID`
852+ Kconfig option, you will need to provide it manually using the
853+ `CONFIG_CHIP_DEVICE_ROTATING_DEVICE_UID` Kconfig value.
854+
855+ - You can generate the test Certification Declaration by using the
856+ `CONFIG_CHIP_FACTORY_DATA_GENERATE_CD=y` Kconfig option. Remember to build
857+ the `chip-cert` application and add it to the system PATH.
858+
797859<hr>
798860
799861## Programming factory data
0 commit comments