Systems and methods for secure certificate use policies
An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and embodied by executable instructions embodied in non-transitory computer readable media, the instructions configured to, when executed by the processor: identify, for a firmware image, a secure boot certificate; identify, for the secure boot certificate, a certificate use policy; determine whether the certificate use policy permits verification of the firmware image using the secure boot certificate; and allow the firmware image to be verified with the secure boot certificate if the certificate use policy permits verification of the firmware image using the secure boot certificate.
1. An information handling system comprising:
a processor; and
a basic input/output system communicatively coupled to the processor and embodied by executable instructions embodied in non-transitory computer readable media, the instructions configured to, when executed by the processor:
identify, for a firmware image, a secure boot certificate;
identify, for the secure boot certificate, a certificate use policy, wherein the certificate use policy is integrated with the secure boot certificate and overrides attributes of the certificate use policy embedded in the secure boot certificate;
determine whether the certificate use policy permits verification of the firmware image using the secure boot certificate; and
allow the firmware image to be verified with the secure boot certificate if the certificate use policy permits verification of the firmware image using the secure boot certificate.
2. The information handling system of claim 1 , wherein the basic input/output system is further configured to disallow the firmware image to be verified with the secure boot certificate if the certificate use policy does not permit verification of the firmware image using the secure boot certificate.
3. The information handling system of claim 1 , wherein attributes of the certificate use policy are embedded in a certificate format arbitrary extension field of the secure boot certificate.
4. The information handling system of claim 1 , wherein the certificate use policy is integrated with the secure boot certificate.
5. The information handling system of claim 1 , wherein the certificate use policy is a default policy associated with the information handling system.
6. A method comprising, in a basic input/output system of an information handling system:
identifying, for a firmware image, a secure boot certificate;
identifying, for the secure boot certificate, a certificate use policy, wherein the certificate use policy is integrated with the secure boot certificate and overrides attributes of the certificate use policy embedded in the secure boot certificate;
determining whether the certificate use policy permits verification of the firmware image using the secure boot certificate; and
allowing the firmware image to be verified with the secure boot certificate if the certificate use policy permits verification of the firmware image using the secure boot certificate.
7. The method of claim 6 , further comprising disallowing the firmware image to be verified with the secure boot certificate if the certificate use policy does not permit verification of the firmware image using the secure boot certificate.
8. The method of claim 6 , wherein attributes of the certificate use policy are embedded in a certificate format arbitrary extension field of the secure boot certificate.
9. The method of claim 6 , wherein the certificate use policy is integrated with the secure boot certificate.
10. The method of claim 6 , wherein the certificate use policy is a default policy associated with the information handling system.
11. An article of manufacture comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, in a basic input/output system of an information handling system:
identify, for a firmware image, a secure boot certificate;
identify, for the secure boot certificate, a certificate use policy, wherein the certificate use policy is integrated with the secure boot certificate and overrides attributes of the certificate use policy embedded in the secure boot certificate;
determine whether the certificate use policy permits verification of the firmware image using the secure boot certificate; and
allow the firmware image to be verified with the secure boot certificate if the certificate use policy permits verification of the firmware image using the secure boot certificate.
12. The article of claim 11 , the instructions for further causing the processor to disallow the firmware image to be verified with the secure boot certificate if the certificate use policy does not permit verification of the firmware image using the secure boot certificate.
13. The article of claim 11 , wherein attributes of the certificate use policy are embedded in a certificate format arbitrary extension field of the secure boot certificate.
14. The article of claim 11 , wherein the certificate use policy is integrated with the secure boot certificate.
15. The article of claim 11 , wherein the certificate use policy is a default policy associated with the information handling system.