Systems and methods to identify a certificate authority within an offline manufacturing facility

1. A method comprising:

generating a secure management mode public-private key pair by a firmware of an information handling system;

generating, by the firmware of the information handling system, a certificate signing request, the certificate signing request including the secure management mode public key of the secure management mode public-private key pair;

sending the secure management mode public key with the certificate signing request to a signing server, the signing server configured to identify a factory certificate authority based on a common name, sign a certificate using the factory certificate authority, and provide a signed certificate, a public key for the factory certificate authority, and a trust chain signed by a trusted root certificate authority;

receiving the signed certificate signed by the factory certificate authority, the public key certificate for the factory certificate authority, and the trust chain signed by the trusted root certificate authority;

validating the signed certificate by the firmware of the information handling system; and

enabling a secure management mode of the information handling system.

2. The method of claim 1 , wherein the common name is associated with the trusted root certificate authority.

3. The method of claim 2 , further comprising encrypting a private key of the secure management mode public-private key pair and storing the encrypted private key.

4. The method of claim 3 , wherein encrypting the private key includes encrypting the private key using a hardware root key.

5. The method of claim 1 , wherein secure management mode enables activating diagnostic ports, reprogramming of identity data, selecting a brand personality, or configuring liquid cooling.

6. A method comprising:

receiving a certificate signing request from a firmware of an information handling system, the certificate signing request including a common name associated with a trusted root certificate authority;

identifying a factory certificate authority based on the common name;

signing a certificate using the factory certificate authority including sending data to a hardware security module and receiving encrypted data back from the hardware security module, the data including a factory certificate authority identifier; and

providing the signed certificate, a public key for the factory certificate authority, and a trust chain signed by the trusted root certificate authority to the information handling system to activate a secure management mode of the information handling system.

7. The method of claim 6 , wherein identifying the factory certificate authority includes looking up the factory certificate authority identifier from a list of common name-factory certificate authority identifier pairs.

8. The method of claim 6 , wherein the hardware security module includes private keys for a plurality of factory certificate authorities including the factory certificate authority.

9. The method of claim 6 , wherein secure management mode enables activating diagnostic ports, reprogramming of identity date, selecting a brand personality, or configuring liquid cooling.

10. A system comprising:

an information handling system having a secure management mode, the information handling system including:

an out-of-band management controller configured to:

store a common name and a public key of a trusted root certificate authority in firmware;

generate a certificate signing request, the certificate signing request including the common name;

send the certificate signing request to a signing server;

receive a certificate signed by a factory certificate authority, a public key for the factory certificate authority, and a trust chain signed by the trusted root certificate authority;

validate the trust chain using the public key of the trusted root certificate authority and the signed certificate using the public key of the factory certificate authority; and

enable secure management mode of the information handling system; and

the signing server including:

a storage configured to store a table of common names and factory certificate authority identifiers; and

a processor configured to:

receive the certificate signing request;

identify the factory certificate authority based on the common name;

sign a certificate using the factory certificate authority; and

provide the signed certificate, a public key for the factory certificate authority, and a trust chain signed by the trusted root certificate authority to the information handling system.

11. The system of claim 10 , wherein the out-of-band management controller is further configured to generate a secure management mode public-private key pair.

12. The system of claim 11 , wherein the out-of-band management controller is further configured to encrypt a private key of the secure management mode public-private key pair and store the encrypted private key.

13. The system of claim 11 , wherein the out-of-band management controller is further configured to encrypt the private key of the secure management mode public-private key pair using a hardware root key.

14. The system of claim 10 , wherein the signing server is further configured to identify the factory certificate authority by looking up a factory certificate authority identifier from a list of common name-factory certificate authority identifier pairs.

15. The system of claim 10 , wherein the signing server is further configured to sign the certificate by sending data to a hardware security module and receiving encrypted data back from the hardware security module.

16. The system of claim 15 , wherein the signing server is further configured to provide the factory certificate authority identifier to the hardware security module.

17. The system of claim 15 , wherein the hardware security module includes private keys for a plurality of factory certificate authorities including the factory certificate authority.

18. The system of claim 10 , wherein secure management mode enables activating diagnostic ports, reprogramming of identity date, selecting a brand personality, or configuring liquid cooling.