HP ProBook 450 G4: Secure Boot 2023 Certificate Update Blocked by Firmware Issue (KI_7)

[HadiMaraqa]

Hello HP Community,

I am experiencing an issue updating the Secure Boot certificates on an HP ProBook 450 G4.

System information

• Model: HP ProBook 450 G4

• BIOS version: P85 Ver. 01.48

• Baseboard ID: 8231

• Secure Boot: Enabled

Issue

Windows reports that the updated Secure Boot certificates are available but have not been applied to the firmware.

The Windows System event log repeatedly reports:

• Event ID 1801: Updated Secure Boot certificates have not been applied to the firmware.

• Event ID 1802: The certificate updates were blocked due to a known firmware issue.

• SkipReason: KI_7

The affected updates include Windows UEFI CA 2023, Option ROM CA 2023, 3P UEFI CA 2023, KEK 2023, and Boot Manager 2023.

I have attempted to trigger the update manually using PowerShell and the Windows Secure Boot update scheduled task. However, the problem persists.

The current status is:

• UEFICA2023Status: InProgress

• UEFICA2023Error: 0x80004005

• Windows UEFI CA 2023 is still missing from the firmware database. 

HP Support Page Advice: 

"Support for HP Commercial PCs outside of service life

For HP Commercial PCs that do not receive a BIOS update because they have reached their End of Service Life (EOSL) date (including select 2018 products and all HP PCs released 2017 and earlier), HP has developed a solution to allow you to update your system manually.

To be updated manually, systems meet the following requirements:

• Run the Windows 11, Windows 10 IoT LTSC, or Windows 10 with Extended Security Updates (ESU) program operating system.

• Meet the system requirements for Windows 11 or Windows 10 IoT LTSC.

Contact HP to receive assistance with this manual process."

I meet the following: Windows 10 with Extended Security Updates (ESU) program operating system.

Questions

1. Is a BIOS update planned to resolve the KI_7 block and allow the 2023 Secure Boot certificates to be installed?

2. If no BIOS update is planned, is there an officially supported and safe workaround for this model?

I would appreciate guidance from an HP representative or someone with relevant firmware expertise.

Thank you.

[Deep_World]

Hi  @HadiMaraqa 
 
Welcome to the HP Support Community!

Thanks for reaching out!

I understand your concern also I can see that you have already performed several advanced steps and gathered event log details, which is very helpful. Dont worry let me check and help you with this. 

To better understand the situation, could you kindly confirm the following:

• Have you ever reset the BIOS to factory defaults and then re-enabled Secure Boot?
• Do you see any additional Secure Boot or TPM-related errors in Event Viewer besides Event IDs 1801 and 1802?

In the meantime, you may try the below steps and confirm : 

1. First kindly back up any important data.
2. Load BIOS defaults: 
   • Restart the notebook and press F10 repeatedly to enter BIOS.
   • Select Restore Defaults.
   • Save the changes and restart the system.
3. Return to BIOS and verify: 
   • Secure Boot is enabled.
   • Legacy Support is disabled.
4. Install any available BIOS updates from HP Support Assistant or the HP support website, even if the current BIOS appears up to date.
   
   Also kindly review the HP guidance for Secure Boot certificate updates and supported systems:  HP Secure Boot Certificate Update Information  

Since the HP ProBook 450 G4 is an older commercial platform, it is possible that this model may fall into the group of systems covered by HP's guidance for devices that may require a manual update process when a BIOS update is not available.

I hope this helps. 

 

[HadiMaraqa]

Hi,

Thank you for your assistance. I have now checked the latest TPM-WMI events and found additional information.

On October 20, 2026, the following errors were recorded:

• Event ID 1802: The Windows UEFI CA 2023, Option ROM CA 2023, 3P UEFI CA 2023, and KEK 2023 updates are blocked due to a known firmware issue, with SkipReason: KI_7.

• Event ID 1797: The Windows UEFI CA 2023 certificate is not present in the firmware database (db).

• Event ID 1796: The Secure Boot update failed to update SBAT with error 0x800700c1.

The device reports BIOS P85 Ver. 01.48 and baseboard ID 8231.

The issue persists despite my previous attempts to trigger the update manually using PowerShell and the Windows Secure Boot update scheduled task.

Regarding your question about restoring the BIOS defaults, I cannot recall whether I have done this previously.

Before proceeding with further BIOS changes, could you please confirm whether restoring the BIOS defaults is still recommended given these repeated KI_7 firmware-blocking events?

I would also appreciate guidance on whether my ProBook 450 G4 qualifies for HP's manual Secure Boot certificate update solution for commercial PCs that have reached end of service life, and the officially supported procedure for this model.

Thank you for your continued assistance.