Can not disable secure boot

[G50-70]

I can't disable secure boot or clear secure boot keys as when I try and clear my keys a blank, blue box appears with nothing inside of it. What I did to get here was just “Reset Secure Boot Keys to Factory Defaults” and now I am stuck with secure boot on. I also can't find the factory reset button in my BIOS and I want to stay on my current BIOS revision. I also used to have secure boot off until this.

I think I am getting Operating System Boot Mode Change (021) when I try and deactivate secure boot but I can see fully as most of it is hidden behind a QR code.

If, needed for any tools I can install windows but I will only if necessary.

My BIOS version is F.15, my laptop is the HP Pavilion 15-eh0000 and my OS is Debian GNU/Linux 13 (trixie) x86_64. I hope someone can help.

PS I think my BIOS needs reflashing but I can not find the f.15 BIOS anywhere so would be nice if somebody can provide me with it. Before anyone asks if I get the 4-digit code, the answer is: I do not.

Thanks

[Pallipurath]

Hi @G50-70 

Welcome to the HP Support Community.

Thank you for posting your query.

I understand that you're facing difficulties disabling Secure Boot or clearing Secure Boot keys, here are steps you can take to resolve the issue:

Access BIOS/UEFI

• Restart your computer.
• As soon as the HP logo appears, repeatedly press the designated key:
• Common keys: F10, F2, Esc, or Delete.
• On most HP laptops, F10 or Esc works.

Navigate to Boot/Security Tab

• Use the arrow keys to move through the BIOS menu.
• Locate either the Boot tab or the Security tab (depending on your BIOS version).

Disable Secure Boot

• Find Secure Boot Configuration.
• Select Secure Boot and change the setting to Disabled.
• If prompted, confirm the change.

Clear Secure Boot Keys (if available)

• Look for an option like Clear Secure Boot Keys.
• Select it to reset the keys.
• If the screen glitches or shows a blank box, restart and try again.

Enable Legacy Support

• In the Boot Options menu, locate Legacy Support.
• Change the setting to Enabled.
• This may also require switching the Boot Mode from UEFI to Legacy.

Save Changes and Exit

• Press F10 (or follow the on‑screen prompt) to Save Changes and Exit.
• A confirmation screen may appear — select Yes.
• Your computer will restart with the new settings applied.

Hope this helps, Please revert if the issue persists.

Take care and have an amazing day!

[G50-70]

Thanks @Pallipurath but:

Firstly, you said "If the screen glitches, restart and try again." I have tried too many times again, the solution is not going to be restarting and restarting then try again every single time.

Secondly, there is no option to enable or disable legacy support.

Thirdly, I hope this helps: 

george@pc2:~$ mokutil --sb-state
SecureBoot enabled
george@pc2:~$ mokutil --pk
[key 1]
Owner: f5a96b31-dba0-4faa-a42a-7a0c9832768e
SHA1 Fingerprint: d5:2a:c7:db:95:4c:16:7a:38:6e:1a:a9:55:24:9a:4d:9b:da:de:dd
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
5f:b6:60:d4:c2:fb:16:6b:65:76:b7:25:7a:4c:37:ab
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=HP Inc., CN=HP Inc. PK 2016 CA
Validity
Not Before: Jan 20 00:00:00 2017 GMT
Not After : Jan 16 23:59:59 2033 GMT
Subject: CN=HP UEFI Secure Boot PK 2017, OU=CODE-SIGN, C=US, O=HP Inc.
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:bc:4c:3f:6d:ef:dc:cc:b7:5e:89:77:e1:68:44:
8b:78:92:14:67:db:e2:83:74:a5:e0:14:fe:0e:d3:
dd:0b:22:ef:b6:5c:5e:36:cc:06:b3:66:7c:cb:66:
e7:62:55:d8:ea:a1:97:ce:eb:ad:84:d8:7d:ad:bc:
b0:2b:06:0c:63:ee:19:d5:a6:da:34:6f:02:54:a0:
f5:e7:72:6e:5e:d5:33:f4:ed:e3:d2:71:15:14:4d:
09:45:1d:d6:1b:6d:3e:a7:f3:32:48:7e:5d:eb:5d:
17:79:53:40:12:af:24:40:12:61:61:b2:b6:ba:53:
2d:8e:cb:79:93:1a:88:df:d1:47:02:ba:78:ad:a0:
4c:32:5b:8c:cf:9c:14:8f:27:7f:0f:99:53:54:c9:
a5:e8:c6:58:9e:b9:9c:42:3b:1b:78:8f:ad:bc:f7:
ac:36:bb:da:2b:c0:2b:53:34:ff:5f:45:53:00:35:
ff:4f:30:49:77:c5:0c:ff:e0:f0:32:82:76:41:3b:
b8:69:f7:c9:9b:1e:11:bb:70:64:ab:d0:ba:f0:50:
21:ca:93:6d:f9:08:3e:cd:e2:cf:d3:42:b7:e8:29:
bc:88:06:c9:1a:a6:49:74:e2:b6:6d:63:53:49:86:
cb:c6:cd:33:5a:6c:bb:bc:4d:2b:c4:fb:7c:52:0c:
72:47
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage: critical
Code Signing
X509v3 Subject Key Identifier:
67:E9:96:F9:D3:5E:DD:4C:AB:00:57:22:F0:1B:28:48:4E:70:FD:F5
X509v3 CRL Distribution Points:
Full Name:
URI:http://pki-crl.symauth.com/ca_3d979b1806776281dc0777551f93d625/LatestCRL.crl

Authority Information Access:
OCSP - URI:http://pki-ocsp.symauth.com
X509v3 Authority Key Identifier:
97:6B:C7:18:FB:F6:6C:5E:6A:39:10:18:B6:25:B5:D9:87:2D:C6:CC
2.16.840.1.113733.1.16.3:
0...`.H...E.............765503
2.16.840.1.113733.1.16.5:
0)....$aHR0cHM6Ly9wa2ktcmEuc3ltYXV0aC5jb20=
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
80:fd:05:b8:39:5f:a0:24:db:4b:cf:e2:a8:1b:7a:dd:d9:58:
66:70:88:40:2d:03:de:d5:ae:59:21:40:36:1a:b6:4c:1c:20:
7b:49:c0:2a:a3:46:1d:fe:70:b9:a4:94:b2:96:13:fd:61:a6:
94:be:14:89:0a:9e:11:cf:ac:e5:86:34:22:4b:c8:8c:a3:6b:
12:7c:df:a9:17:98:0b:20:7b:68:91:74:6e:ea:a3:f8:f6:19:
80:b6:99:d1:f3:9b:8c:58:42:19:1c:c4:59:d6:22:4d:b9:ae:
21:06:8d:a9:6d:9e:9c:b9:95:65:11:31:11:f6:9e:65:a8:d5:
db:99:54:dc:97:8b:da:c2:f5:1e:06:09:a9:d3:2a:97:11:66:
77:45:48:fd:07:84:eb:ec:c2:84:5f:17:1a:5b:c1:09:50:3d:
72:64:bf:ee:fe:31:0c:9b:0a:fc:cb:48:f7:f1:83:39:5a:54:
43:80:1d:29:b6:72:c2:ec:b6:8a:39:5e:68:2f:d6:a4:3e:52:
12:7f:5a:0a:16:cd:32:28:76:21:88:6f:f3:c5:fb:5b:24:89:
35:6c:fb:af:e5:6d:aa:ed:8b:ca:69:fc:10:22:5f:25:4a:6f:
fd:9d:24:1c:52:8c:93:46:1c:bd:51:44:45:90:65:19:2f:53:
2d:f2:14:77

Hope you can actually help this time.

Thanks.

[Pallipurath]

Hi @G50-70.

Thank you for responding.

I would request you to please perform the below steps share and for guidance I would request you to follow the link. https://www.youtube.com/watch?v=t3S3KgcT-Ao.

Preparation

• Identify your notebook’s product number
• Found on a label on the bottom of the notebook or on the shipping box.
• Do not rely on the series name (like “HP Pavilion”)—you need the exact product number.
• Get a blank USB flash drive
• Use a standard USB‑A drive (not USB‑C).
• Minimum size: 8 GB is recommended.
• Back up any data on it, as it will be erased.

Download BIOS Recovery Files

• On the second working computer, go to HP Customer Support – Software and Driver Downloads.
• Navigate to your notebook’s product page using the product number.
• Select BIOS from the list of drivers.
• Review the details carefully to ensure it matches your notebook model.
• Installing the wrong BIOS can permanently damage the system.
• Click Download, then Run.
• Approve the User Account Control prompt.
• The HP BIOS Update and Recovery utility will open.

Create the Recovery USB

• In the InstallShield Wizard:
• Click Next.
• Accept the license agreement.
• Click Next again.
• In the HP BIOS Update and Recovery window:
• Select Create Recovery USB flash drive.
• Click Next.
• Choose your USB flash drive from the list.
• Click Next.
• Wait while BIOS files are copied to the drive.
• When you see “The recovery flash drive was created successfully”, click Finish.
• Remove the USB drive safely.

Using the Recovery Drive

• Insert the recovery USB into the notebook that needs BIOS recovery.
• Power on the notebook and immediately press the Windows key + B (or sometimes V) while holding the Power button for 2–3 seconds.
• Release the Power button but keep holding Windows + B/V until the BIOS recovery screen appears.
• Follow the on‑screen instructions to restore the BIOS.

Hope this helps, Please follow the link for Guidance.

Have good day.

[G50-70 · Accepted solution]

@Pallipurath
Fixed!
Hold Windows + V and power button for 3 seconds, clear the CMOS from there, boot back into BIOS and try to disable secure boot again.