2023 Secure Boot Certificates

[jeobsplyr]

Hello Again.  I followed the instructions you gave me.  I ran the script, and again, no luck.  This is the results of running the script ( I ran it 2 ways, with Sure Start protection enabled and disabled:

I don't know, maybe I'm doing something wrong.  Please advise.

[j_o_n_a_s]

Hmm, I do not recognize these errors. Maybe @NonSequitur777 does? 

[NonSequitur777]

@j_o_n_a_s,

@jeobsplyr's screenshot is actually quite helpful, and I don't think he's doing anything wrong.

Looking at the output, the script is successfully passing all of its preliminary checks:

• It recognizes the system as an HP commercial PC.
• It detects the HP BIOS/SBKPF capability.
• It detects the existing 2017 Secure Boot key set.
• BitLocker is OK.
• The script then gets as far as actually trying to enroll the 2023 certificates.

The failure occurs at that last step:

Failed to enroll Microsoft Corporation KEK 2K CA 2023 in KEK database

and

Failed to enroll Windows UEFI CA 2023 in db database

Those are firmware Secure Boot databases. In other words, Windows/the script is making the request, but the UEFI firmware is refusing the write. That's quite different from the script simply being run incorrectly.

It's also significant that the OP already tried HP's manual 2023 certificate package and that didn't work either. Now he has tried the script with Sure Start enabled and disabled and obtained the same result. Taken together, that makes a firmware-level issue much more likely than user error.

Before trying anything else -especially clearing Secure Boot keys or changing the Platform Key- I would suggest collecting a little more information.

First, please tell us the exact BIOS version currently installed on the EliteBook 840 G5.

Second, immediately after reproducing the failure, open:

Event Viewer → Applications and Services Logs → Microsoft → Windows → TPM-WMI → Admin

and look for events generated at the time of the failed enrollment. In particular, please report any 1795, 1801, 1803, or 1808 events.

It would also be useful to verify whether the certificates were actually written to firmware despite what the script reported. From an elevated PowerShell window, please run: Confirm-SecureBootUEFI

and:

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).Bytes) -match 'Windows UEFI CA 2023')

and:

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).Bytes) -match 'Microsoft Corporation KEK 2K CA 2023')

@jeobsplyr please post the results of those commands along with the BIOS version and any TPM-WMI events.

One other point: I would not assume that the existing 2017 Platform Key needs to be replaced. There are reports of the 840 G5 successfully receiving the 2023 KEK/db certificates while retaining its existing 2017 PK.

So, I would not clear or replace the Secure Boot keys until we know exactly what the firmware is rejecting.

At this stage, I think we have established that the problem isn't simply a matter of running the script incorrectly.

The next step is to identify precisely why the 840 G5 firmware is refusing the KEK/db updates.

Kind Regards,

NonSequitur777

[jeobsplyr]

Hello again, My Friend.  Results of Powershell commands:

My current BIOS is HPQ78, version 01.31,00, 3/10/25

Hope this information helps. PEACE!!

[NonSequitur777]

@jeobsplyr,

Yes — thank you. I reviewed the screenshot again, and your results are clear:

• BIOS: HPQ78 01.31.00, 03/10/2025
• Secure Boot: True
• Windows UEFI CA 2023 in db: False
• Microsoft Corporation KEK 2K CA 2023 in KEK: False

So, the 2023 certificates have definitely not been enrolled in the firmware.

At this point, I think we have taken the troubleshooting about as far as we reasonably can from Windows. You've now tried both HP's manual certificate package and the HP enrollment script, and you've also tested the procedure with Sure Start Secure Boot Protection enabled and disabled. The result is the same: the firmware refuses the KEK/db update.

I don't want to send you through another series of Secure Boot resets, Platform Key changes, or other potentially disruptive experiments just to see if something happens to work. Your existing Secure Boot configuration is functional, and there's no good reason to risk breaking it.

The remaining question is a firmware-specific one: why this particular Q78 01.31.00 firmware is refusing the 2023 KEK/db enrollment. The TPM-WMI Event 1802/KI_7 information we found earlier points toward an HP firmware-side restriction/known issue rather than something you're doing incorrectly.

Therefore, my recommendation was and is to stop making changes to the Secure Boot databases.  If HP Support can't assist you either with this firmware/security issue, I'm afraid this is a dead end

As I mentioned before, when contacting HP, I would describe it this way:

EliteBook 840 G5, BIOS Q78 01.31.00. Windows UEFI CA 2023 and Microsoft Corporation KEK 2K CA 2023 cannot be enrolled. HP's manual 2023 certificate package and HP's automated enrollment script both fail. Secure Boot is enabled and functional, but the 2023 KEK/db certificates remain absent. Sure Start Secure Boot Protection was tested both enabled and disabled with the same result. Please determine whether Q78 01.31.00 has a firmware limitation/known issue preventing the 2023 Secure Boot certificate update and whether HP has a firmware update or approved remediation for this platform.

I know this isn't the satisfying answer after all the testing you've done, but I don't think it would be responsible for us to keep having you change Secure Boot variables when the evidence increasingly points to the firmware itself.

You haven't been doing anything wrong. We've established that pretty conclusively.

Kind Regards,

NonSequitur777

[jeobsplyr]

Good Morning My Friend. I was surprised to see you're response yesterday. Just goes to show how respected your expertise is. I just thought it would be useful to find someone who actually installed the certificates on an HP Elitebook 840 G5, and see if there's a piece of the puzzle missed. As you can see, I attempted a few times to install the certificates, but without success. So, I'm inclined to agree with your assessment of reaching a "dead end". A little disappointed..yes. But, glad my device is still fully functional and secure. I meant to tell you, my desktop (HP Pavilion 590-p0054), received the 2023 secure boot certificates. It's an older desktop also, but, must have been ok'd to receive the certificates. Anyway, thank you again for all your help. I guess some problems can't be solved. I learned a great deal interacting with you in attempting to fix the issue. You helped me "smooth out" a few bumps in the road with my devices. I appreciate it immensely. Take good care.....PEACE AND BLESSINGS!!!

[NonSequitur777]

@jeobsplyr,

You are most welcome!

Wishing you well and Safe Harbor,

NonSequitur777