Enable Secure boot with custom Keys

[0xHex]

Hi,

I've seen this topic several time in the Forum, but I do not find a clear answer.

I want to enable Secure Boot and use my own keys:

As it says in the documentation: https://h10032.www1.hp.com/ctg/Manual/c06696065.pdf

When checked and system is rebooted, custom secure
boot keys are imported from the EFI\HP directory from
the hard drive or USB device. The custom keys consist of
PK, KEK, DB, and Dbx .bin files. When import succeeds or
fails, a preboot prompt shows the results of each key bin
file.

Then, I format a USB 4GB stick as follows (I've tried with msdos partition table too):

When checked and system is rebooted, custom secure
boot keys are imported from the EFI\HP directory from
the hard drive or USB device. The custom keys consist of
PK, KEK, DB, and Dbx .bin files. When import succeeds or
fails, a preboot prompt shows the results of each key bin
file.

HP_BIOS$ tree .
.
└── EFI
   └── HP
       ├── DB.bin
       ├── DBX.bin
       ├── KEK.bin
       └── PK.bin

3 directories, 4 files

But I have the following error:

"Failed to import Secure Boot custom * from \EFI\HP\*.bin, or the file was not found.

This is my current setup:

What I am doing wrong?

Thanks,

Javier

[70007]

Hello 0xHex,

Thank you for posting your concern,

To enable Secure Boot and use your own custom Secure Boot keys on an HP system, you need to follow a specified process. Here is a general outline of the steps involved:

1. Prepare Your Keys: Before proceeding with the setup, ensure you have your custom Platform Key (PK), Key Exchange Keys (KEK), and signatures for trusted execution (DB and DBX) ready. These should be stored as .bin files.
2. Access Secure Boot Settings:
   • Access the BIOS Setup by pressing the appropriate key during the system boot (usually F10 for HP systems).
   • Navigate to the Security tab and select Secure Boot Configuration.
3. Set Up for Custom Keys:
   • Set Secure Boot to Enabled.
   • Change Key Management from HP Keys to Custom Keys. This will disable Secure Boot temporarily, allowing changes to the key database.
4. Import Your Custom Keys:
   • Place your .bin files (PK, KEK, DB, DBX) in the EFI\HP directory on your primary hard drive or a USB device.
   • Reboot your system. The system should prompt you about importing keys. Follow the on-screen instructions to proceed with the import.
5. Verify the Import Process:
   • You may be notified whether the import succeeded or failed. Make sure your keys are aligned correctly if there is any failure.
6. Final Steps:
   • Once your custom keys are successfully imported, you can re-enable Secure Boot. The system will now use your customized keys for boot validation.

These steps allow you to ensure that only your specified software can be executed during the boot process, enhancing the security of your system with your selected keys.

Ensure that you carefully manage your keys and follow any specific detailed instructions that apply to your particular system and BIOS version.