PKI and Boot Managers Under the CRA (EN 304 623 & 624)

Boot managers (EN 304 623) and PKI software (EN 304 624) are classified as Important Class I — their compromise undermines the entire security chain they protect.

Boot Managers — EN 304 623

Boot managers are the first software that runs when a device starts. They control what operating system loads and whether the boot chain is trustworthy. CRA requirements:

• Secure Boot support — Verify signatures of boot components
• Measured Boot — Record boot measurements for remote attestation
• Recovery mechanisms — Ability to recover from a failed or compromised boot
• Update security — Signed updates with rollback protection

Affected products include GRUB, systemd-boot, Windows Boot Manager, and UEFI firmware implementations.

PKI Software — EN 304 624

Certificate authorities, key management systems, and digital certificate issuance software. This is where trust in digital identities begins. Requirements emphasize:

• Hardware security module (HSM) integration for private key protection
• Certificate lifecycle management (issuance, renewal, revocation)
• Audit logging of all certificate operations
• Compliance with existing PKI standards (CA/Browser Forum Baseline Requirements)