Crypto Authentication devices currently support compressed certificates with encoded issue years and expiry years, but only up to the year 2031. The cryptoauthlib aka CAL library has updated (with CALv3.7.5 release) the compressed certificate format to extend support for certificate issue and expiry years beyond the year 2031.

This section details the required changes and provides guidance on updating cryptoauthlib to use the upgraded format.

This update may impact existing users who utilize compressed certificates with CAL library versions lesser than v3.7.5.

• Current Limitation:
  CAL compressed certificates using format 0 (the default) support certificate issue and expiry years only up to 2031

• New Support:
  To allow certificate validity beyond 2031, a new compressed certificate format (format 1) is introduced

• Affected Module:
  These changes specifically impact the atcacert module of the CAL library

• Certificate Size: 72 bytes
• Format Version:
  • Byte 70 - Lower 4 bits: 0b0000 (format 0)
• Encoded Dates:
  • Bytes 64–66: Encoded issue and expiry years

Encoded dates i.e., bytes 64 – 66 is detailed as below

1. Byte 70: Format Version Update

   • The Format Version is incremented from 0 to 1 to reflect the new encoding scheme.

2. Byte 71: Bit Reallocation

• issue_year is now constructed using:

  • Byte 64 → Bits 3 to 7 (5 bits)
  • Byte 71 → Bits 6 and 7 (2 bits)
  • Total: 7 bits → allows representing years from 0 to 127

  issue_year = { Byte 64 :: Bits 3–7 } + { Byte 71 :: Bits 6–7 }
  

• expire_years is now constructed using:

  • Byte 66 → Bits 0 to 4 (5 bits)
  • Byte 71 → Bits 4 and 5 (2 bits)
  • Total: 7 bits → allows representing years from 0 to 127

  expire_year = { Byte 64 :: Bits 3–7 } + { Byte 71 :: Bits 6–7 }
  

For users seeking extended year (format 1) support, select the appropriate patch to add format-1 support on top of their current CAL code. This allows continued use of devices provisioned with either format 0 or 1 certificates.

Make a note of an appropriate patch to be applied to your cryptoauthlib

Download the patch release file from the official GitHub release page using your browser or a command-line tool:
Download Patch Release

Based on the upgrade requirement, slect and copy the appropriate extended_year_v3xy.patch to your cryptoauthlib folder and apply it using the following command

cd <cryptoauthlib folder>

git apply extended_year_v3xy.patch

Alternately

patch -p1 < extended_year_v3xy.patch

Check whether the patch has been applied successfully

Refer Configuration Page for details to build CAL as per your existing build configuration