Update UEFI Secure Boot Certificate to 2023

[Jaws650]

I have updated this laptop (model 15dy2795wm) to the December BIOS, and I've run Windows Update. I am still running Windows 11 23H2 (and cannot update to 24H2, it kills wifi and it's rejecting driver updates to the Realtek chip, after the '144 version, that might -- not necessarily will, but might -- leave it functional). I do not (and will not) run any automatic-update system, or an assistant that allows remote access.

I am still getting "false" querying the system for whether the 2011 certificate has been updated to 2023 using PowerShell.

Please provide instructions on manually updating that certificate... and don't tell me to just run Windows Update, actually read the request (especially if "you" are a chatbot that is just looking for keywords).

[Deep_World]

Hi @Jaws650,
 
Welcome to the HP Support Community!

Thanks for reaching out!

We're thrilled to have the opportunity to assist you and provide a solution.

Sorry for the inconvenience caused don’t worry let me help you.

To better understand the issue, could you please provide a few more details?

• Whether you’ve seen any error messages during the BIOS update process or when checking Secure Boot in the firmware setup utility.
• If you’ve tried verifying the certificate directly from the UEFI firmware interface rather than only through Windows.

Here are a few troubleshooting steps you might try in the meantime:

• Check BIOS settings manually: Restart the laptop, press Esc or F10 to enter BIOS Setup, and under Security → Secure Boot Configuration, confirm whether the Secure Boot keys show the 2023 Microsoft UEFI CA certificate.
• Clear and re‑enroll keys: In BIOS, you may have the option to clear Secure Boot keys and then re‑enroll factory defaults. This can sometimes refresh the certificate store if the update didn’t apply correctly.
• HP Support Assistant : Even though you prefer not to use automatic update tools, you can manually download the latest BIOS/firmware package for your model from HP’s support website and apply it directly. Sometimes the bundled update includes Secure Boot key updates that Windows Update alone doesn’t push.

I hope this helps.

I'm glad I could help! 😊 If this resolved your issue, please mark it as "Accepted Solution" and click "Yes" on "Was this reply helpful?" Your feedback not only keeps us going but also helps others find the solution faster! 

Take care and have an amazing day ahead! 

Best regards,

Deep_World

[Jaws650]

Further specific notes:

I have already updated the BIOS to the most-recent available. I do not use Support Assistant, but regularly maintain drivers and such through manual downloading. That knocks out two and a half of the suggestions in that 18 Feb message (that, as noted above, got routed to spam).

And I'm not willing to try the other items -- monkeying with BIOS settings -- for "sometimes." That's just stupid, and your own access to what's in the BIOS updates should tell you whether "sometimes" means "yes" or "no" for this.