A system for secure booting of an information handling system stores a Root of Trust private key in a hardware security module (HSM). A HSM-Integrated certificate creation utility receives inputs such as bin files for each firmware volume associated with a boot sequence. The HSM-Integrated certificate creation utility loads the correct extensions for the firmware volume, generates a certificate signing request (CSR) and generates a certificate based on the CSR. The certificates can be provided to a boot sequence for processing in a trusted firmware implementation without a certificate creation utility consuming the Hardware Root of Trust private key as a file that could be compromised.