Custom keys on secure boot...

[jqtrd_arch]

I know a few posts regarding the ease of secure boot/custom keys have been made before, and I've seen most of them...

I'm *attempting* to enable secure boot for my gentoo installation, but there are a few issues: shim-lock, the supposed hassle free method, apparently uses the 3rd party Microsoft CA cert. except such is not included in the firmware db, only Windows Production PCA 2011 and Windows UEFI CA 2023. so using that results in an invalid secure boot signature on shimx64.efi.

Next I tried using custom keys. This was initially difficult as there is no clear enroll/setup mode in the BIOS. it turns out I just had to clear all the keys in db (this does, however, make the laptop not properly boot in UEFI mode for some reason. the basic efivars are there, but not enough to completely function. such that many automated enrollment methods do not work, as they expect an efi environment. so i did it manually instead. booted with secure boot off, all db, pk, kek, etc. cleared, and installed the keys using the `efi-updatevar` command in linux, then enabled secure boot.

Surprisingly, this actually worked, and secure boot was successful, and that was the end of it. but it turns out that after rebooting a few times, the firmware nvram just loses, or 'forgets' my custom keys, and the pk, and db are all empty. and at the same time the BootOrder variable is also lost for some reason.

fyi, laptop is hp laptop 14-ep0529sa (BN4M5EA). BIOS is F.18, I have updated once from F.17 (version from factory)

[BeemerBiker]

This absolutely should not happen.  The only thing I can think of is a bios recovery was initiated when the bios sensed a problem.  I have seen that option on some motherboards:  After xxx failed starts go to yyy default setting.

Maybe this is helpful since you have technical skills.

I looked at your bios list for win11 25h2 and unfortunately, I cannot tell which bios is the one to use

F.08 and F.19 are both dated May 2026 and both are for Intel CPUs which does not make sense based on the number series and the 17 bios is dated 2025 which makes it older than the F.08

If your current bios is 17 then possibly you should be upgraded to 19.  Perhaps our expert @Paul_Tikkanen 

might know which bios to use. 

Use the latest support assistant and see if it recommends the F.19  bios.  Putting in the wrong bios could cause a fatal problem.