Microsoft Secure Boot with Debian on live usb.

[romain254]

Hello,
I work exclusively with Debian (Live USB).
For several days now, debian has been telling me at each boot "Apply all available updates from your regular operating system to update to the latest Secure boot certificates of Microsoft".
I can't find a solution to install these new certificates and I don't know where to install them.
Can you help me find a solution?
Sincerely,
Romain.

Description: HP Laptop 17-cn0546nf

Product Number: 6J9T8EA

Bios :

Insyde, F.25, 04/18/2023

[VikramTheGreat]

Hi @romain254,

Welcome to the HP Support Community.
 

Thank you for posting your query. I will be glad to help you.

Thank you for providing the notebook details. I understand why this message is concerning, especially when you're using Debian Live USB exclusively.

The message you're seeing is generally related to the Microsoft Secure Boot certificates stored in the system firmware (UEFI). Since you're booting Debian in Secure Boot mode, Debian is detecting that the Secure Boot certificate database may need to be updated.

The first thing I'd recommend is updating your notebook to the latest BIOS version available from HP, as BIOS updates often include firmware improvements and Secure Boot certificate updates.

You can download the latest BIOS for your HP Laptop 17-cn0546nf (Product Number: 6J9T8EA) here: HP Laptop 17-cn0546nf (6J9T8EA) Software and Driver Details

Before updating the BIOS:

• Connect the notebook to the HP AC adapter.
• If possible, perform the BIOS update from a supported Windows environment, as HP BIOS update packages are validated for Windows systems.
• Do not interrupt the update process once it has started.

After the BIOS update completes:

1. Restart the notebook and enter the BIOS Setup by pressing Esc repeatedly at startup, then F10.
2. Verify that Secure Boot is still enabled if you intend to continue using it.
3. Save any changes and restart the notebook.
4. Boot into Debian again and check whether the Secure Boot certificate message still appears.

Could you also let me know:

• Is Windows still installed on the notebook, or are you running Debian Live USB only?
• Are you using Secure Boot enabled, or have you changed any BIOS security settings recently?

If the BIOS is already updated to the latest version and the message continues, please let me know. I'll be happy to help you review the Secure Boot configuration further.

I hope this helps.

Take care and have an amazing day!