diff --git a/Makefile b/Makefile
index 65ebb93..fa711e2 100644
--- a/Makefile
+++ b/Makefile
@@ -1201,7 +1201,7 @@
 
 .PHONY: ${CRTTOOL}
 ${CRTTOOL}:
-	${Q}${MAKE} PLAT=${PLAT} USE_TBBR_DEFS=${USE_TBBR_DEFS} COT=${COT} --no-print-directory -C ${CRTTOOLPATH}
+	${Q}${MAKE} PLAT=${PLAT} USE_TBBR_DEFS=${USE_TBBR_DEFS} COT=${COT} OPENSSL_DIR=${OPENSSL_DIR} --no-print-directory -C ${CRTTOOLPATH}
 	@${ECHO_BLANK_LINE}
 	@echo "Built $@ successfully"
 	@${ECHO_BLANK_LINE}
@@ -1267,7 +1267,7 @@
 
 .PHONY: ${ENCTOOL}
 ${ENCTOOL}:
-	${Q}${MAKE} PLAT=${PLAT} BUILD_INFO=0 --no-print-directory -C ${ENCTOOLPATH}
+	${Q}${MAKE} PLAT=${PLAT} BUILD_INFO=0 OPENSSL_DIR=${OPENSSL_DIR} --no-print-directory -C ${ENCTOOLPATH}
 	@${ECHO_BLANK_LINE}
 	@echo "Built $@ successfully"
 	@${ECHO_BLANK_LINE}
diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst
index bfc50df..630d861 100644
--- a/docs/getting_started/build-options.rst
+++ b/docs/getting_started/build-options.rst
@@ -721,6 +721,10 @@
   bit, to trap access to the RAS ERR and RAS ERX registers from lower ELs.
   This flag is disabled by default.
 
+- ``OPENSSL_DIR``: This flag is used to provide the installed openssl directory
+  path on the host machine which is used to build certificate generation and
+  firmware encryption tool.
+
 GICv3 driver options
 --------------------
 
diff --git a/drivers/auth/dualroot/cot.c b/drivers/auth/dualroot/cot.c
index 31e5d65..68f3d46 100644
--- a/drivers/auth/dualroot/cot.c
+++ b/drivers/auth/dualroot/cot.c
@@ -693,8 +693,8 @@
  * Secure Partitions
  */
 #if defined(SPD_spmd)
-static const auth_img_desc_t sp_content_cert = {
-	.img_id = SP_CONTENT_CERT_ID,
+static const auth_img_desc_t sip_sp_content_cert = {
+	.img_id = SIP_SP_CONTENT_CERT_ID,
 	.img_type = IMG_CERT,
 	.parent = &trusted_key_cert,
 	.img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
@@ -775,14 +775,14 @@
 	}
 };
 
-DEFINE_SP_PKG(1);
-DEFINE_SP_PKG(2);
-DEFINE_SP_PKG(3);
-DEFINE_SP_PKG(4);
-DEFINE_SP_PKG(5);
-DEFINE_SP_PKG(6);
-DEFINE_SP_PKG(7);
-DEFINE_SP_PKG(8);
+DEFINE_SIP_SP_PKG(1);
+DEFINE_SIP_SP_PKG(2);
+DEFINE_SIP_SP_PKG(3);
+DEFINE_SIP_SP_PKG(4);
+DEFINE_SIP_SP_PKG(5);
+DEFINE_SIP_SP_PKG(6);
+DEFINE_SIP_SP_PKG(7);
+DEFINE_SIP_SP_PKG(8);
 #endif /* SPD_spmd */
 
 #else  /* IMAGE_BL2 */
@@ -914,15 +914,15 @@
 	[BL33_IMAGE_ID]				=	&bl33_image,
 	[NT_FW_CONFIG_ID]			=	&nt_fw_config,
 #if defined(SPD_spmd)
-	[SP_CONTENT_CERT_ID]			=	&sp_content_cert,
-	[SP_CONTENT_CERT_ID + 1]		=	&sp_pkg1,
-	[SP_CONTENT_CERT_ID + 2]		=	&sp_pkg2,
-	[SP_CONTENT_CERT_ID + 3]		=	&sp_pkg3,
-	[SP_CONTENT_CERT_ID + 4]		=	&sp_pkg4,
-	[SP_CONTENT_CERT_ID + 5]		=	&sp_pkg5,
-	[SP_CONTENT_CERT_ID + 6]		=	&sp_pkg6,
-	[SP_CONTENT_CERT_ID + 7]		=	&sp_pkg7,
-	[SP_CONTENT_CERT_ID + 8]		=       &sp_pkg8,
+	[SIP_SP_CONTENT_CERT_ID]		=	&sip_sp_content_cert,
+	[SP_PKG1_ID]				=	&sp_pkg1,
+	[SP_PKG2_ID]				=	&sp_pkg2,
+	[SP_PKG3_ID]				=	&sp_pkg3,
+	[SP_PKG4_ID]				=	&sp_pkg4,
+	[SP_PKG5_ID]				=	&sp_pkg5,
+	[SP_PKG6_ID]				=	&sp_pkg6,
+	[SP_PKG7_ID]				=	&sp_pkg7,
+	[SP_PKG8_ID]				=       &sp_pkg8,
 #endif
 };
 #endif
diff --git a/drivers/auth/tbbr/tbbr_cot_bl2.c b/drivers/auth/tbbr/tbbr_cot_bl2.c
index 63c18fa..65a0478 100644
--- a/drivers/auth/tbbr/tbbr_cot_bl2.c
+++ b/drivers/auth/tbbr/tbbr_cot_bl2.c
@@ -558,8 +558,8 @@
 };
 /* Secure Partitions */
 #if defined(SPD_spmd)
-static const auth_img_desc_t sp_content_cert = {
-	.img_id = SP_CONTENT_CERT_ID,
+static const auth_img_desc_t sip_sp_content_cert = {
+	.img_id = SIP_SP_CONTENT_CERT_ID,
 	.img_type = IMG_CERT,
 	.parent = &trusted_key_cert,
 	.img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) {
@@ -640,14 +640,14 @@
 	}
 };
 
-DEFINE_SP_PKG(1);
-DEFINE_SP_PKG(2);
-DEFINE_SP_PKG(3);
-DEFINE_SP_PKG(4);
-DEFINE_SP_PKG(5);
-DEFINE_SP_PKG(6);
-DEFINE_SP_PKG(7);
-DEFINE_SP_PKG(8);
+DEFINE_SIP_SP_PKG(1);
+DEFINE_SIP_SP_PKG(2);
+DEFINE_SIP_SP_PKG(3);
+DEFINE_SIP_SP_PKG(4);
+DEFINE_SIP_SP_PKG(5);
+DEFINE_SIP_SP_PKG(6);
+DEFINE_SIP_SP_PKG(7);
+DEFINE_SIP_SP_PKG(8);
 #endif /* SPD_spmd */
 
 static const auth_img_desc_t * const cot_desc[] = {
@@ -672,15 +672,15 @@
 	[BL33_IMAGE_ID]				=	&bl33_image,
 	[NT_FW_CONFIG_ID]			=	&nt_fw_config,
 #if defined(SPD_spmd)
-	[SP_CONTENT_CERT_ID]			=	&sp_content_cert,
-	[SP_CONTENT_CERT_ID + 1]		=	&sp_pkg1,
-	[SP_CONTENT_CERT_ID + 2]		=	&sp_pkg2,
-	[SP_CONTENT_CERT_ID + 3]		=	&sp_pkg3,
-	[SP_CONTENT_CERT_ID + 4]		=	&sp_pkg4,
-	[SP_CONTENT_CERT_ID + 5]		=	&sp_pkg5,
-	[SP_CONTENT_CERT_ID + 6]		=	&sp_pkg6,
-	[SP_CONTENT_CERT_ID + 7]		=	&sp_pkg7,
-	[SP_CONTENT_CERT_ID + 8]		=       &sp_pkg8,
+	[SIP_SP_CONTENT_CERT_ID]		=	&sip_sp_content_cert,
+	[SP_PKG1_ID]				=	&sp_pkg1,
+	[SP_PKG2_ID]				=	&sp_pkg2,
+	[SP_PKG3_ID]				=	&sp_pkg3,
+	[SP_PKG4_ID]				=	&sp_pkg4,
+	[SP_PKG5_ID]				=	&sp_pkg5,
+	[SP_PKG6_ID]				=	&sp_pkg6,
+	[SP_PKG7_ID]				=	&sp_pkg7,
+	[SP_PKG8_ID]				=       &sp_pkg8,
 #endif
 };
 
diff --git a/fdts/cot_descriptors.dtsi b/fdts/cot_descriptors.dtsi
index 753d56a..9308e17 100644
--- a/fdts/cot_descriptors.dtsi
+++ b/fdts/cot_descriptors.dtsi
@@ -146,8 +146,8 @@
 		};
 
 #if defined(SPD_spmd)
-		sp_content_cert: sp_content_cert {
-			image-id = <SP_CONTENT_CERT_ID>;
+		sip_sp_content_cert: sip_sp_content_cert {
+			image-id = <SIP_SP_CONTENT_CERT_ID>;
 			parent = <&trusted_key_cert>;
 			signing-key = <&trusted_world_pk>;
 			antirollback-counter = <&trusted_nv_counter>;
@@ -251,50 +251,50 @@
 
 #if defined(SPD_spmd)
 		sp_pkg1 {
-			image-id = <SP_CONTENT_CERT_ID + 1>;
-			parent = <&sp_content_cert>;
+			image-id = <SP_PKG1_ID>;
+			parent = <&sip_sp_content_cert>;
 			hash = <&sp_pkg1_hash>;
 		};
 
 		sp_pkg2 {
-			image-id = <SP_CONTENT_CERT_ID + 2>;
-			parent = <&sp_content_cert>;
+			image-id = <SP_PKG2_ID>;
+			parent = <&sip_sp_content_cert>;
 			hash = <&sp_pkg2_hash>;
 		};
 
 		sp_pkg3 {
-			image-id = <SP_CONTENT_CERT_ID + 3>;
-			parent = <&sp_content_cert>;
+			image-id = <SP_PKG3_ID>;
+			parent = <&sip_sp_content_cert>;
 			hash = <&sp_pkg3_hash>;
 		};
 
 		sp_pkg4 {
-			image-id = <SP_CONTENT_CERT_ID + 4>;
-			parent = <&sp_content_cert>;
+			image-id = <SP_PKG4_ID>;
+			parent = <&sip_sp_content_cert>;
 			hash = <&sp_pkg4_hash>;
 		};
 
 		sp_pkg5 {
-			image-id = <SP_CONTENT_CERT_ID + 5>;
-			parent = <&sp_content_cert>;
+			image-id = <SP_PKG5_ID>;
+			parent = <&sip_sp_content_cert>;
 			hash = <&sp_pkg5_hash>;
 		};
 
 		sp_pkg6 {
-			image-id = <SP_CONTENT_CERT_ID + 6>;
-			parent = <&sp_content_cert>;
+			image-id = <SP_PKG6_ID>;
+			parent = <&sip_sp_content_cert>;
 			hash = <&sp_pkg6_hash>;
 		};
 
 		sp_pkg7 {
-			image-id = <SP_CONTENT_CERT_ID + 7>;
-			parent = <&sp_content_cert>;
+			image-id = <SP_PKG7_ID>;
+			parent = <&sip_sp_content_cert>;
 			hash = <&sp_pkg7_hash>;
 		};
 
 		sp_pkg8 {
-			image-id = <SP_CONTENT_CERT_ID + 8>;
-			parent = <&sp_content_cert>;
+			image-id = <SP_PKG8_ID>;
+			parent = <&sip_sp_content_cert>;
 			hash = <&sp_pkg8_hash>;
 		};
 #endif
diff --git a/include/common/tbbr/tbbr_img_def.h b/include/common/tbbr/tbbr_img_def.h
index e057891..b29b135 100644
--- a/include/common/tbbr/tbbr_img_def.h
+++ b/include/common/tbbr/tbbr_img_def.h
@@ -10,7 +10,7 @@
 #include <export/common/tbbr/tbbr_img_def_exp.h>
 
 #if defined(SPD_spmd)
-#define SP_CONTENT_CERT_ID		MAX_IMAGE_IDS
+#define SIP_SP_CONTENT_CERT_ID		MAX_IMAGE_IDS
 #define SP_PKG1_ID			(MAX_IMAGE_IDS + 1)
 #define SP_PKG2_ID			(MAX_IMAGE_IDS + 2)
 #define SP_PKG3_ID			(MAX_IMAGE_IDS + 3)
diff --git a/include/drivers/auth/auth_mod.h b/include/drivers/auth/auth_mod.h
index 01d144d..504e539 100644
--- a/include/drivers/auth/auth_mod.h
+++ b/include/drivers/auth/auth_mod.h
@@ -51,11 +51,11 @@
 extern unsigned int auth_img_flags[MAX_NUMBER_IDS];
 
 #if defined(SPD_spmd)
-#define DEFINE_SP_PKG(n) \
+#define DEFINE_SIP_SP_PKG(n) \
 	static const auth_img_desc_t sp_pkg##n = { \
-		.img_id = SP_CONTENT_CERT_ID + (n), \
+		.img_id = SP_PKG##n##_ID, \
 		.img_type = IMG_RAW, \
-		.parent = &sp_content_cert, \
+		.parent = &sip_sp_content_cert, \
 		.img_auth_methods = (const auth_method_desc_t[AUTH_METHOD_NUM]) { \
 			[0] = { \
 				.type = AUTH_METHOD_HASH, \
diff --git a/make_helpers/defaults.mk b/make_helpers/defaults.mk
index 9a6fd58..caf5990 100644
--- a/make_helpers/defaults.mk
+++ b/make_helpers/defaults.mk
@@ -308,3 +308,6 @@
 
 # Build option to create cot descriptors using fconf
 COT_DESC_IN_DTB			:= 0
+
+# Build option to provide openssl directory path
+OPENSSL_DIR			:= /usr
diff --git a/plat/arm/common/fconf/arm_fconf_io.c b/plat/arm/common/fconf/arm_fconf_io.c
index 48cc4fe..350ecd1 100644
--- a/plat/arm/common/fconf/arm_fconf_io.c
+++ b/plat/arm/common/fconf/arm_fconf_io.c
@@ -51,7 +51,7 @@
 	[TRUSTED_OS_FW_CONTENT_CERT_ID] = {UUID_TRUSTED_OS_FW_CONTENT_CERT},
 	[NON_TRUSTED_FW_CONTENT_CERT_ID] = {UUID_NON_TRUSTED_FW_CONTENT_CERT},
 #if defined(SPD_spmd)
-	[SP_CONTENT_CERT_ID] = {UUID_SIP_SECURE_PARTITION_CONTENT_CERT},
+	[SIP_SP_CONTENT_CERT_ID] = {UUID_SIP_SECURE_PARTITION_CONTENT_CERT},
 #endif
 #endif /* ARM_IO_IN_DTB */
 #endif /* TRUSTED_BOARD_BOOT */
@@ -184,9 +184,9 @@
 		open_fip
 	},
 #if defined(SPD_spmd)
-	[SP_CONTENT_CERT_ID] = {
+	[SIP_SP_CONTENT_CERT_ID] = {
 		&fip_dev_handle,
-		(uintptr_t)&arm_uuid_spec[SP_CONTENT_CERT_ID],
+		(uintptr_t)&arm_uuid_spec[SIP_SP_CONTENT_CERT_ID],
 		open_fip
 	},
 #endif
@@ -233,7 +233,7 @@
 	{TRUSTED_OS_FW_CONTENT_CERT_ID, "tos_fw_content_cert_uuid"},
 	{NON_TRUSTED_FW_CONTENT_CERT_ID, "nt_fw_content_cert_uuid"},
 #if defined(SPD_spmd)
-	{SP_CONTENT_CERT_ID, "sp_content_cert_uuid"},
+	{SIP_SP_CONTENT_CERT_ID, "sip_sp_content_cert_uuid"},
 #endif
 #endif /* TRUSTED_BOARD_BOOT */
 };
diff --git a/plat/arm/common/fconf/arm_fconf_sp.c b/plat/arm/common/fconf/arm_fconf_sp.c
index 64e873e..4459264 100644
--- a/plat/arm/common/fconf/arm_fconf_sp.c
+++ b/plat/arm/common/fconf/arm_fconf_sp.c
@@ -30,7 +30,7 @@
 	union uuid_helper_t uuid_helper;
 	unsigned int index = 0;
 	uint32_t val32;
-	const unsigned int sp_start_index = SP_CONTENT_CERT_ID + 1;
+	const unsigned int sp_start_index = SP_PKG1_ID;
 
 	/* As libfdt use void *, we can't avoid this cast */
 	const void *dtb = (void *)config;
@@ -45,6 +45,11 @@
 	}
 
 	fdt_for_each_subnode(sp_node, dtb, node) {
+		if (index == MAX_SP_IDS) {
+			ERROR("FCONF: Reached max number of SPs\n");
+			return -1;
+		}
+
 		err = fdt_read_uint32_array(dtb, sp_node, "uuid", 4,
 					    uuid_helper.word);
 		if (err < 0) {
@@ -87,15 +92,10 @@
 		policies[sp_start_index + index].check = open_fip;
 
 		index++;
-
-		if (index >= MAX_SP_IDS) {
-			ERROR("FCONF: reached max number of SPs\n");
-			return -1;
-		}
 	}
 
 	if ((sp_node < 0) && (sp_node != -FDT_ERR_NOTFOUND)) {
-		ERROR("%d: fdt_for_each_subnode(): %d\n", __LINE__, node);
+		ERROR("%u: fdt_for_each_subnode(): %d\n", __LINE__, node);
 		return sp_node;
 	}