Secure Boot 2023 certificate update compatibility — HP 15-bs070wm, BIOS F.75

[EddieGV]

I am humbly requesting technical clarification concerning UEFI Secure Boot certificate updates on an older HP notebook.

Hardware and firmware configuration:

• Model: HP 15-bs070wm

• Product number: 1WP50UA#ABA

• System board ID: 832A

• Firmware: InsydeH2O, HP BIOS F.75

• BIOS release date reported by DMI: 26 April 2024

• Operating system: Debian GNU/Linux 13, x86-64

• Secure Boot: Enabled

The firmware currently contains the original Microsoft 2011 certificates, including Microsoft Corporation UEFI CA 2011 in the Secure Boot signature database (db) and Microsoft Corporation KEK CA 2011 in KEK.

The active Secure Boot databases (PK, KEK, db, dbx) have been verified to contain exactly the same data as their corresponding factory-default databases.

I would like to enrol Microsoft UEFI CA 2023 while preserving the existing trusted certificates, so that the laptop can continue booting Linux distributions using newer Microsoft-signed EFI bootloaders.

Microsoft provides an authenticated update payload, DBUpdate3P2023.bin, for this purpose. The intended procedure would be an authenticated append to the UEFI db variable from Linux.

I am aware of the following Red Hat advisory concerning compatibility issues with standalone Secure Boot database updates on certain HP firmware implementations:

https://access.redhat.com/articles/7128933

Could you please clarify the following technical points?

1. Does BIOS F.75 on the HP 15-bs070wm (system board 832A) correctly support authenticated updates to the Secure Boot db variable using EFI_VARIABLE_APPEND_WRITE and time-based authenticated variable updates?

2. Is this particular model or firmware version known to be affected by issues in which a standalone db append operation fails, replaces existing trusted certificates, or prevents subsequent system startup?

3. Is there an HP-supported procedure for installing Microsoft UEFI CA 2023 on this model, or a newer compatible BIOS version that explicitly supports the certificate transition?

4. Does the BIOS option Load HP Factory Default Keys restore all the original active Secure Boot databases if an update corrupts their contents?

5. Does the HP Win+B BIOS recovery procedure restore the UEFI nonvolatile variable store, including Secure Boot databases, or does it restore only the firmware executable regions?

6. Does HP provide a supported method to create a complete firmware and NVRAM backup for this model, suitable for restoring the machine following an unsuccessful firmware-variable update?

The machine currently works correctly, and no certificate modification has yet been attempted.

I would prefer to establish compatibility before proceeding, particularly since the update involves persistent firmware security variables.

A model-specific answer, firmware compatibility reference, or recommendation would be greatly appreciated.

Thank you for your assistance.

Kind regards

[Paul_Tikkanen]

Hi:

HP has not provided any documentation regarding the 2023 secure boot certificate updates for consumer notebooks.

The only information I can provide is the guidance for HP business PCs from the link below:

HP Business PCs - Prepare for new Windows Secure Boot certificates | HP® Support

Your PC's hardware does not natively support W11, and it was most likely made prior to 2019.

Therefore, no BIOS update was released to support the 2023 secure boot certificate updates.

This info from Microsoft explains the consequences of not having the 2023 secure boot certificates installed.

When Secure Boot certificates expire on Windows devices | Microsoft Support

If you want to try and update the 2023 secure boot certificates, proceed at your own risk.