HP ProBook 450 G4: Secure Boot 2023 Certificate Update Blocked by Firmware Issue (KI_7)

[HadiMaraqa]

Hello HP Community,

I am experiencing an issue updating the Secure Boot certificates on an HP ProBook 450 G4.

System information

• Model: HP ProBook 450 G4

• BIOS version: P85 Ver. 01.48

• Baseboard ID: 8231

• Secure Boot: Enabled

Issue

Windows reports that the updated Secure Boot certificates are available but have not been applied to the firmware.

The Windows System event log repeatedly reports:

• Event ID 1801: Updated Secure Boot certificates have not been applied to the firmware.

• Event ID 1802: The certificate updates were blocked due to a known firmware issue.

• SkipReason: KI_7

The affected updates include Windows UEFI CA 2023, Option ROM CA 2023, 3P UEFI CA 2023, KEK 2023, and Boot Manager 2023.

I have attempted to trigger the update manually using PowerShell and the Windows Secure Boot update scheduled task. However, the problem persists.

The current status is:

• UEFICA2023Status: InProgress

• UEFICA2023Error: 0x80004005

• Windows UEFI CA 2023 is still missing from the firmware database. 

HP Support Page Advice: 

"Support for HP Commercial PCs outside of service life

For HP Commercial PCs that do not receive a BIOS update because they have reached their End of Service Life (EOSL) date (including select 2018 products and all HP PCs released 2017 and earlier), HP has developed a solution to allow you to update your system manually.

To be updated manually, systems meet the following requirements:

• Run the Windows 11, Windows 10 IoT LTSC, or Windows 10 with Extended Security Updates (ESU) program operating system.

• Meet the system requirements for Windows 11 or Windows 10 IoT LTSC.

Contact HP to receive assistance with this manual process."

I meet the following: Windows 10 with Extended Security Updates (ESU) program operating system.

Questions

1. Is a BIOS update planned to resolve the KI_7 block and allow the 2023 Secure Boot certificates to be installed?

2. If no BIOS update is planned, is there an officially supported and safe workaround for this model?

I would appreciate guidance from an HP representative or someone with relevant firmware expertise.

Thank you.

[Deep_World]

Hi  @HadiMaraqa 
 
Welcome to the HP Support Community!

Thanks for reaching out!

I understand your concern also I can see that you have already performed several advanced steps and gathered event log details, which is very helpful. Dont worry let me check and help you with this. 

To better understand the situation, could you kindly confirm the following:

• Have you ever reset the BIOS to factory defaults and then re-enabled Secure Boot?
• Do you see any additional Secure Boot or TPM-related errors in Event Viewer besides Event IDs 1801 and 1802?

In the meantime, you may try the below steps and confirm : 

1. First kindly back up any important data.
2. Load BIOS defaults: 
   • Restart the notebook and press F10 repeatedly to enter BIOS.
   • Select Restore Defaults.
   • Save the changes and restart the system.
3. Return to BIOS and verify: 
   • Secure Boot is enabled.
   • Legacy Support is disabled.
4. Install any available BIOS updates from HP Support Assistant or the HP support website, even if the current BIOS appears up to date.
   
   Also kindly review the HP guidance for Secure Boot certificate updates and supported systems:  HP Secure Boot Certificate Update Information  

Since the HP ProBook 450 G4 is an older commercial platform, it is possible that this model may fall into the group of systems covered by HP's guidance for devices that may require a manual update process when a BIOS update is not available.

I hope this helps. 

 

[HadiMaraqa]

Hi,

Thank you for your assistance. I have now checked the latest TPM-WMI events and found additional information.

On October 20, 2026, the following errors were recorded:

• Event ID 1802: The Windows UEFI CA 2023, Option ROM CA 2023, 3P UEFI CA 2023, and KEK 2023 updates are blocked due to a known firmware issue, with SkipReason: KI_7.

• Event ID 1797: The Windows UEFI CA 2023 certificate is not present in the firmware database (db).

• Event ID 1796: The Secure Boot update failed to update SBAT with error 0x800700c1.

The device reports BIOS P85 Ver. 01.48 and baseboard ID 8231.

The issue persists despite my previous attempts to trigger the update manually using PowerShell and the Windows Secure Boot update scheduled task.

Regarding your question about restoring the BIOS defaults, I cannot recall whether I have done this previously.

Before proceeding with further BIOS changes, could you please confirm whether restoring the BIOS defaults is still recommended given these repeated KI_7 firmware-blocking events?

I would also appreciate guidance on whether my ProBook 450 G4 qualifies for HP's manual Secure Boot certificate update solution for commercial PCs that have reached end of service life, and the officially supported procedure for this model.

Thank you for your continued assistance.

[Deep_World]

Hi @HadiMaraqa,

Thank you for the update and for sharing the additional event details. Based on the KI_7 firmware block and the repeated Secure Boot certificate update failures, this appears to be a firmware compatibility limitation rather than a Windows issue.

As a next step, I recommend:

1. Back up any important data.
2. Enter the BIOS (F10 at startup) and restore BIOS defaults, then save and restart.
3. Re-enter BIOS and confirm:  
   Secure Boot -Enabled 
   Legacy Support -Disabled
4. Check once more for any BIOS updates available for your system.
5. Review HP's Secure Boot certificate guidance here: HP Secure Boot Certificate Update Information 
   
    

[HadiMaraqa]

Hi,

Thank you for the continued assistance.

I understand your recommendation to restore the BIOS defaults and verify the Secure Boot settings. I will take the necessary precautions regarding my BitLocker-encrypted drives before making any BIOS changes.

I have also confirmed that my installed BIOS is P85 Ver. 01.48, which appears to match HP's published BIOS package for the ProBook 450 G4.

Since the repeated Event ID 1802 errors explicitly report SkipReason: KI_7, could you please clarify whether restoring the BIOS settings to their defaults is expected to address this specific firmware block?

I also reviewed HP's Secure Boot certificate guidance, which mentions a manual certificate update solution for eligible commercial PCs that have reached end of service life.

Could you please confirm whether my ProBook 450 G4 and its installed operating system qualify for that solution, and provide the official procedure if they do?

Thank you for your help.

[Deep_World]

Hi @HadiMaraqa,

Thank you for the update and for sharing the additional event details.
 

Based on the repeated KI_7 firmware block events and the Secure Boot certificate update failures, this appears to be related to a firmware limitation on the platform rather than a Windows configuration issue. While restoring BIOS defaults is a reasonable troubleshooting step, As further check  may be required, I kindly recommend contacting HP Phone Support. The support team can review your device's eligibility for the manual Secure Boot certificate update process, verify the firmware status, They'll work with you one-on-one to get the issue sorted, possibly with some remote assistance magic.

1) Click on this link—    https://support.hp.com/contact

2) Add or select the product, and change/select your region.

3) Enter the serial number of your device or select Let HP detect your product option.

4) Choose "other" option from the list

5) Select continue to contact option

You should see the HP phone support number or Chat option listed.

They will guide you further.

Or, You may also visit the nearest HP authorized service center, the service team will check and assist you.

Kindly follow this link to locate the nearest HP service center:    https://support.hp.com/us-en/help/service-center

(Select the country from the dropdown menu and enter the city name or pincode)

Have a wonderful day!

Did we resolve the issue? If yes, Please consider marking this post as "Accepted Solution" and click "Yes" to give us a helpful vote - your feedback keeps us going!

Regards,

Deep_World