Generate SuperMicro IPMI license

Thank-you, Peter Kleissner, for saving me from having to use my time machine to simply update my server’s BIOS: https://peterkleissner.com/2018/05/27/reverse-engineering-supermicro-ipmi/

Supermicro IPMI License Key (for updating BIOS) = HMAC-SHA1-96(INPUT: MAC address of BMC, SECRET KEY: 85 44 E3 B4 7E CA 58 F9 58 30 43 F8)

echo -n 'bmc-mac' | xxd -r -p | openssl dgst -sha1 -mac HMAC -macopt hexkey:8544E3B47ECA58F9583043F8 | awk '{print $2}' | cut -c 1-24

43 thoughts on “Generate SuperMicro IPMI license”

  1. It can be improved a bit. Add:
    | fold -w4 | paste -sd’-‘ –
    to the end of command, so it will be formatted with dashes.

    Then it could be used in such command:
    ./sum -i 123.123.123.123 -u ADMIN1 -p PASSWORD1 -c ActivateProductKey –key $(supermicro-gen-licence.sh)

    1. Thanks. I had a CPU that required a later version than what was on the board when it arrived. Updated the BIOS without a CPU no worries. X11SCL-F

  2. confirmed to work on a X11SDV motherboard. But I have to input the key in a Chrome based browser(I use edge), it does not work in Firefox 80.0.1.

  3. Thank you a million. Saved my machine. I don’t really want to wait around for supermicro to email me back eventually and have to maybe pay for it. Though if it was only $30 I would happily pay it. Amazing work

  4. I have a X12SCA-F and that asks for a licence file to be uploaded, but it just complains the file is in the wrong format. The only section which seems to need the licence is Mouse Mode under remote control.

    Mind you the board is that new that there are no BIOS updates and the IPMI is very flaky, sometimes I can get into the BIOS sometimes not.

    1. Same issue regarding needing a file to be uploaded and showing the wrong format. Did you figure out the format required?

    2. Seems that SuperMicro changed the way of activating the license between X11 and X12 (and presumably between H11 and H12) generations. Their eStore manual notes that you get a key string from their key generation tool for X11 based systems, while for X12 based systems you get a key file. See “How to Generate Out of Band (OOB) Keys”: https://store.supermicro.com/pub/media/wysiwyg/productspecs/SFT-OOB-LIC/How-to-generate-OOB-keys.pdf (https://store.supermicro.com/out-of-band-sft-oob-lic.html => “Resources”). I’m afraid you’re out of luck with your board, at least with this method.

  5. i assume that i have to have a POSTing machine wihich is failing at cpu stage? My board (x10dri-ln4+) wont post with INTEL error B7, possibel to still get into ipmi??

  6. echo -n ‘bmc-mac’ | xxd -r -p | openssl dgst -sha1 -mac HMAC -macopt hexkey:8544E3B47ECA58F9583043F8 | awk ‘{print $2}’ | cut -c 1-24 | awk ‘{print substr($1,1,4),”-“,substr($1,5,4),”-“,substr($1,9,4),”-“,substr($1,13,4),”-“,substr($1,17,4),”-“,substr($1,21,4)}’

  7. an PHP implementation:

    public function calcActivationCode(string $BMC_MAC) {
    return implode(
    ‘ – ‘, array_slice(
    str_split(
    hash_hmac(
    ‘sha1’, hex2bin(
    preg_replace(
    ‘![^A-F0-9]!i’, ”, $BMC_MAC
    )
    ), hex2bin(‘8544E3B47ECA58F9583043F8’)
    ), 4), 0, 6)
    );
    }

  8. Looking for a similar solution for ibm/lenovo 3650m4, anyone got a clue on that? hard to get a license for a resonably cost on a end-of-life machine like that :\

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.