Request for EOSL manual Secure Boot certificate update solution (ProBook 450 G5)

[daniele115]

According to support document "HP Business PCs - Prepare for new Windows Secure Boot certificates" (https://support.hp.com/ca-en/document/ish_13070353-13070429-16), HP provides on request a manual update solution for Commercial PCs outside of service life.

I request this solution for my device, which meets the requirements listed in the aforementioned document:

- Product: HP ProBook 450 G5, baseboard 837D, SKU 2XY63EA
- BIOS: HP Q85 Ver. 01.31.00, 15/01/2025 (latest BIOS version released for this device)
- OS: Windows 10 Pro 22H2, build 19045.7663, enrolled in the Extended Security Updates (ESU) program

- Hardware: meets Windows 11 system requirements (8th-gen Intel Core, TPM 2.0)

Current device state: UEFI 2023 CA certificates have been downloaded by Windows and are available on the device, but have not been applied to firmware. System is logging at each boot TPM-WMI events ID 1797, 1801 and 1802 with the following information.

DeviceAttributes: FirmwareManufacturer:HP;FirmwareVersion:Q85 Ver. 01.31.00;OEMModelBaseBoard:837D;OEMManufacturerName:HP;OSArchitecture:amd64;
BucketId: 08909f2af20a4b6bf9655d3fecff53837246411520134922325b18fe6505097a
BucketConfidenceLevel: High Confidence
UpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)

Can you please provide details about the manual update procedure and the necessary packages, if needed?

Thanks in advance

[Hawks_Eye]

Hi @daniele115 

Welcome to the HP Support Community! We're here to help you get back up and running.

Thank you for providing the detailed system information. I understand you are looking for the manual Secure Boot certificate update solution referenced in the HP document for an HP ProBook 450 G5 that is no longer receiving platform-specific BIOS updates.

Based on the HP support document HP Business PCs - Prepare for new Windows Secure Boot certificates, HP states that for certain HP Commercial PCs that have reached End of Service Life (EOSL), a manual solution has been developed to support the installation of the new Microsoft 2023 Secure Boot certificates when a dedicated BIOS update is not available. 

For your specific HP ProBook 450 G5 platform:

• The system appears to meet the processor and Secure Boot eligibility requirements you outlined.
• BIOS version Q85 01.31.00 is the latest BIOS currently published for this platform.
• The TPM-WMI Event IDs 1797, 1801, and 1802 indicate Windows has detected that the Microsoft 2023 certificates are available but have not yet been committed into firmware. [support.hp.com]

However, the public HP documentation does not publish:

• The manual update package name.
• The SoftPaq number.
• The manual deployment procedure.
• The supported platform list for the EOSL package.

The document only confirms that such a solution exists for qualifying EOSL commercial platforms.

Take care, and have an amazing day!

Regards, 

Hawks_Eye