A diagnostic access authentication system for a vehicle having a controller area network, the system comprising: a diagnostic interface connected to the CAN and configured to interface with an external testing tool; a set of components connected to the CAN and configured to be the subject of a set of diagnostics; and a controller connected to the CAN and configured to perform a diagnostic authentication procedure including: receiving, from the external testing tool, a request for diagnostic access to the vehicle, the request comprising a public key certificate specifying a diagnostic role, wherein the external testing tool obtains the public key certificate from a public key infrastructure computing system that stores and does not share a corresponding private key certificate; transmitting, to the external testing tool, an authentication challenge, wherein receipt of the authentication challenge causes the external testing tool to transmit the authentication challenge to the PKI computing system, receive a signed authentication challenge comprising a digital signature from the PKI computing system, and transmit the signed authentication challenge to the controller via the diagnostic interface; receiving, from the external testing tool, the signed authentication challenge; determining whether the digital signature of the signed authentication challenge is valid using the public key certificate; when the digital signature is valid, unlocking a set of diagnostics associated with the diagnostic role; and when any of the set of unlocked diagnostics associated with the diagnostic role match any of the set of diagnostics for the set of components, granting the external testing tool diagnostic access to the vehicle, thereby causing the external testing tool to execute the one or more matched diagnostics. a diagnostic interface connected to the CAN and configured to interface with an external testing tool; a set of components connected to the CAN and configured to be the subject of a set of diagnostics; and a controller connected to the CAN and configured to perform a diagnostic authentication procedure including: receiving, from the external testing tool, a request for diagnostic access to the vehicle, the request comprising a public key certificate specifying a diagnostic role, wherein the external testing tool obtains the public key certificate from a public key infrastructure computing system that stores and does not share a corresponding private key certificate; transmitting, to the external testing tool, an authentication challenge, wherein receipt of the authentication challenge causes the external testing tool to transmit the authentication challenge to the PKI computing system, receive a signed authentication challenge comprising a digital signature from the PKI computing system, and transmit the signed authentication challenge to the controller via the diagnostic interface; receiving, from the external testing tool, the signed authentication challenge; determining whether the digital signature of the signed authentication challenge is valid using the public key certificate; when the digital signature is valid, unlocking a set of diagnostics associated with the diagnostic role; and when any of the set of unlocked diagnostics associated with the diagnostic role match any of the set of diagnostics for the set of components, granting the external testing tool diagnostic access to the vehicle, thereby causing the external testing tool to execute the one or more matched diagnostics. receiving, from the external testing tool, a request for diagnostic access to the vehicle, the request comprising a public key certificate specifying a diagnostic role, wherein the external testing tool obtains the public key certificate from a public key infrastructure computing system that stores and does not share a corresponding private key certificate; transmitting, to the external testing tool, an authentication challenge, wherein receipt of the authentication challenge causes the external testing tool to transmit the authentication challenge to the PKI computing system, receive a signed authentication challenge comprising a digital signature from the PKI computing system, and transmit the signed authentication challenge to the controller via the diagnostic interface; receiving, from the external testing tool, the signed authentication challenge; determining whether the digital signature of the signed authentication challenge is valid using the public key certificate; when the digital signature is valid, unlocking a set of diagnostics associated with the diagnostic role; and when any of the set of unlocked diagnostics associated with the diagnostic role match any of the set of diagnostics for the set of components, granting the external testing tool diagnostic access to the vehicle, thereby causing the external testing tool to execute the one or more matched diagnostics.