Did you manually update your Secure Boot Keys ?

starchase said:

Looks like the HP Spectre laptop has a firmware limitation. I've been discussing this with Copilot and I run up against a hard wall.

"You’ve diagnosed it exactly right. On your HP Spectre x360, the “Clear All Secure Boot Keys” option wipes the PK/KEK/db/dbx databases, which forces the system into Setup Mode. In that state, Secure Boot can’t be enabled because there are no keys to enforce. When you reload HP Factory Default Keys, the firmware repopulates those databases with the original 2016 set, and Secure Boot becomes available again.

"That behavior confirms the limitation: HP’s firmware only trusts its own factory key bundle, and it doesn’t provide a path for you to insert updated Microsoft certificates manually. Mosby can’t override that because the firmware rejects non‑OEM KEKs once User Mode is active."

So, indeed a BIOS update from HP is required and they already say none is forthcoming. tant pis, peu importe!

Click to expand...

i have two HP all in one systems, purchased in 2022, both have the same BIOS setup as yours.
(both of these all in ones are made with laptop components)

i have updated both secure boot certs to the new 2023 secure boot certs
without doing anything in or to the BIOS


using the secure boot update HowTo

best of luck Steve ..

starchase said:

Looks like the HP Spectre laptop has a firmware limitation. I've been discussing this with Copilot and I run up against a hard wall.

"You’ve diagnosed it exactly right. On your HP Spectre x360, the “Clear All Secure Boot Keys” option wipes the PK/KEK/db/dbx databases, which forces the system into Setup Mode. In that state, Secure Boot can’t be enabled because there are no keys to enforce. When you reload HP Factory Default Keys, the firmware repopulates those databases with the original 2016 set, and Secure Boot becomes available again.

"That behavior confirms the limitation: HP’s firmware only trusts its own factory key bundle, and it doesn’t provide a path for you to insert updated Microsoft certificates manually. Mosby can’t override that because the firmware rejects non‑OEM KEKs once User Mode is active."

So, indeed a BIOS update from HP is required and they already say none is forthcoming. tant pis, peu importe!

Click to expand...

I'm having pretty much the same issue with an unsupported Lenovo laptop. Tried to use Mosby and it installed the keys ( sort of ) and messed up Secure Boot so that I couldn't turn it back on again. Blew out all the keys to factory and reinstalled windows, then did the entries to reinstall the Windows UEFI CA 2023 key so that I could re-image from a backup. It was an interesting experiment, as I only need the 2023 KEK key, but I've had enough. Spent untold hours messing with it. The one clue that may explain the issue was when Mosby finished updating all the keys, there was a warning error about a Security Violation, when checking all the keys installed there seemed to have been a error reading a PK key.

starchase said:

Looks like the HP Spectre laptop has a firmware limitation. I've been discussing this with Copilot and I run up against a hard wall.

"You’ve diagnosed it exactly right. On your HP Spectre x360, the “Clear All Secure Boot Keys” option wipes the PK/KEK/db/dbx databases, which forces the system into Setup Mode. In that state, Secure Boot can’t be enabled because there are no keys to enforce. When you reload HP Factory Default Keys, the firmware repopulates those databases with the original 2016 set, and Secure Boot becomes available again.

"That behavior confirms the limitation: HP’s firmware only trusts its own factory key bundle, and it doesn’t provide a path for you to insert updated Microsoft certificates manually. Mosby can’t override that because the firmware rejects non‑OEM KEKs once User Mode is active."

So, indeed a BIOS update from HP is required and they already say none is forthcoming. tant pis, peu importe!

Click to expand...

The first bit seems logically right to me. But once you "Clear All Secure Boot Keys" you don't want to enable secure boot, you want to boot straight into the USB EFI boot drive with Secure Boot disabled. And you'd not want to reload HP factory Default Keys either before booting into MOSBY, or after a successful run, but after failing it's the way to get back to square one.

But then it seems completely illogical that they'd give you the setting to "Clear All Secure Boot Keys" -- which puts it in Setup Mode -- and then NOT allow installing keys, the reason for the existence of Setup Mode. Not saying HP wouldn't prevent users from updating keys... HP, Dell and Lenovo are all quite famous for completely screwing their customers with proprietary twists on their implementations of industry standards... but why even allow clearing the keys in the first place.

Frankly, it puts me off on ever buying a laptop. Just get a cheap throw-away Android tablet or Chromebook for portability.

XxXxX said:

i have two HP all in one systems, purchased in 2022, both have the same BIOS setup as yours.
(both of these all in ones are made with laptop components)

i have updated both secure boot certs to the new 2023 secure boot certs
without doing anything in or to the BIOS
View attachment 154569

using the secure boot update HowTo

Secure boot update HowTo

i have put this together as i had problems updating 2 desktops and 3 laptops. which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert also the other post about this were getting very long and confusing. this is in two parts. part A and part B. edit by me. please...

www.elevenforum.com

best of luck Steve ..

Click to expand...

Yes, I've used your instructions to work my other 3 computers, 2 laptops and an ASUS desktop, with success, so thanks very much for your detailed instructions, I've saved them in a text file for future use. But I'm currently getting a Security Violation (see below) when I ran mosby tonight. And my Spectre was made in Feb 2016, and HP may have done things a bit strange. But, hey, if I hear of any uses of mosby that are different than the current iteration I will give that a shot.

Mosby.log

[Mosby session started: 2025-11-27 19:09:37 [UTC]
UEFI v2.40 (American Megatrends, 0x0005000A)
American Megatrends Inc. F.54
Hewlett-Packard HP Spectre x360 Convertible 13
Reusing existing MosbyKey.crt certificate...
Not installing SBAT since this system's SBAT is either the same or newer
Generating PK certificate...
Installing SSPV: 'SkuSiPolicyVersion [2023.04.29]'
Installing SSPU: 'SkuSiPolicyUpdateSigners [2023.04.29]'
Installing DBX: 'Windows Bootmgr SVN 7.0 DBX update [2025-06-06]'
Failed to set Secure Boot variable: Security Violation
[Mosby session ended: 2025-11-27 19:09:40 [UTC]

[Mosby session started: 2025-11-27 19:54:58 [UTC]
UEFI v2.40 (American Megatrends, 0x0005000A)
American Megatrends Inc. F.54
Hewlett-Packard HP Spectre x360 Convertible 13
Reusing existing MosbyKey.crt certificate...
Not installing SBAT since this system's SBAT is either the same or newer
Generating PK certificate...
Installing SSPV: 'SkuSiPolicyVersion [2023.04.29]'
Installing SSPU: 'SkuSiPolicyUpdateSigners [2023.04.29]'
Installing DBX: 'Windows Bootmgr SVN 7.0 DBX update [2025-06-06]'
Failed to set Secure Boot variable: Security Violation
[Mosby session ended: 2025-11-27 19:55:30 [UTC]

there is another forum member with similar problems updating the secure boot cert of one of their systems
and it looks like there is no 2023 cert available for that particular system
i wondering if that applies to your system as well at this time.

Microsoft will be releasing an update but for which computers and there specs are unknown at this time.
apart from the lack of data in regard to which systems are going to be updated and when.

best of luck Steve ..

XxXxX said:

there is another forum member with similar problems updating the secure boot cert of one of their systems
and it looks like there is no 2023 cert available for that particular system
i wondering if that applies to your system as well at this time.

Microsoft will be releasing an update but for which computers and there specs are unknown at this time.
apart from the lack of data in regard to which systems are going to be updated and when.

best of luck Steve ..

Click to expand...

Yeah, it does seem like there will be quite a few users like me with perfectly good machines that currently use Secure Boot but won't be able to update and will resort to having Secure Boot disabled. I've gotten the feeling that this won't be that big of a deal so I'm not going to get too worked up about it. It's too bad HP has decided to pick 2017 as the last year supported. Oh well.

I'm still learning here. Interesting statement here Security Violation on Dell XPS 15 9570 Notebook · Issue #6 · pbatard/Mosby that may explain my HP specific situation, pbatard writes:

"I'm not sure why you are quoting this to me. As I mentioned in this elevenforum thread which you know about, the UEFI specs are pretty clear that if Mosby reports that the platform is in Setup Mode but the Secure Boot variables can't be written, then the UEFI firmware does not comply to the UEFI specs. Therefore that Dell UEFI firmware of yours is not UEFI compliant if it reported a security violation when writing the Secure Boot variables after Mosby validated that the relevant UEFI variables said that, per specs, the platform reported to be in Setup Mode."

So it may be likely that the HP UEFI firmware also does not comply with the UEFI specification. He mentions that some manufactures played "fast and loose" with the specification, resulting in firmware incapable of being written in Setup Mode.

please have a look at this about enrolling your own MOK key on a Windows 11 system

that may unlock secure boot so updating the 2023 cert could be made possible.
best of luck Steve ..

XxXxX said:

please have a look at this about enrolling your own MOK key on a Windows 11 system

MOK (Machine Owner Key) for Secure Boot

On Dell machines, there does not appear to be a MOK (Machine Owner Key) management and I was reading this which mentions the different UEFI keys: https://blog.hansenpartnership.com/the-meaning-of-all-the-uefi-keys/ Would MOK actually be one of those?

www.elevenforum.com

that may unlock secure boot so updating the 2023 cert could be made possible.
best of luck Steve ..

Click to expand...

Is Machine Owner Key (MOK) Dell's name for PK (Platform Key)?

Buddywh said:

Is Machine Owner Key (MOK) Dell's name for PK (Platform Key)?

Click to expand...

it looks like it is but this maybe of help

best of luck Steve ..

XxXxX said:

this maybe of help

The Meaning of all the UEFI Keys | James Bottomley's random Pages

blog.hansenpartnership.com

best of luck Steve ..

Click to expand...

That was an interesting read. One of the more interesting things I got out of it is apparently the KEK can be used to validate boot manager files for booting an OS. Since the KEK is signed by and validated by the PK it's trust chain is solidly linked to it. A DB key, in contrast, can be signed and then validated by any KEK, regardless of the PK that KEK was validated with. This would make it possible to link an OS to one specific machine or "class" of machines. That sounds like a way to limit use of proprietary OS's I suppose: the machines would require a PK and KEK signed by it to run the OS.

They would have to maintain tight control on the PK and KEK certificates signed by it, and of course the OS would only operate in UEFI/Secure Boot so there's no disabling it and starting anyway.

Buddywh said:

That was an interesting read. One of the more interesting things I got out of it is apparently the KEK can be used to validate boot manager files for booting an OS. Since the KEK is signed by and validated by the PK it's trust chain is solidly linked to it. A DB key, in contrast, can be signed and then validated by any KEK, regardless of the PK that KEK was validated with. This would make it possible to link an OS to one specific machine or "class" of machines. That sounds like a way to limit use of proprietary OS's I suppose: the machines would require a PK and KEK signed by it to run the OS.

They would have to maintain tight control on the PK and KEK certificates signed by it, and of course the OS would only operate in UEFI/Secure Boot so there's no disabling it and starting anyway.

Click to expand...

the idea is with your own MOK is that you control the secure boot/TPM infrastructure and data
as its your key it should let you take control and update the secure boot certs which Windows requires to boot.

this is not a major problem on newish systems as the secure boot cert is updatable
but on older systems that they, whoever they maybe, have stated wont get updated certs.

i had to do this on Ubuntu Linux 16 or 18 LTS as the secure boot keys weren't made available for Linux at that time
once i had created my own MOK then i was able to use the Debian boot shim for Ubuntu Linux to use secure boot.

a bit off topic
best of luck Steve ..

Will a tutorial be put out for those of us that aren't experts in Secure Boot and certificates? I have (3) older/unsupported devices. Since I barely use the oldest one, I opted to attempt and run Mosby yesterday...no luck. I followed the steps on the Mosby GitHub site...only result was an image security validation error. I'm sure it is operator (me) error...what should I try or what am I failing to do properly:

1) I disabled Secure Boot in the BIOS...restart
2) I created a UEFI Shell boot disk using Rufus and the instructions provided on the Mosby Page...I selected/used the UEFI Shell 2.2 25H2 option.
3) I downloaded the latest Mosby zip file...2.7. I extracted it and cut/paste the contents onto the drive...it replaces 7 files (I think) that were originally created by the UEFI Shell process.
4) I start machine, hit the function key to load boot menu, and select the drive...it attempts but fails with error.
5) I also tried booting the drive without copying the latest Mosby files to it...still didn't work.

The only other thing I can think of is that I did see a "clear certificates" option in the BIOS...security tab where I disabled Secure Boot. I was fearful of doing that as I don't know what the consequences are.

mccmw said:

Will a tutorial be put out for those of us that aren't experts in Secure Boot and certificates? I have (3) older/unsupported devices. Since I barely use the oldest one, I opted to attempt and run Mosby yesterday...no luck. I followed the steps on the Mosby GitHub site...only result was an image security validation error. I'm sure it is operator (me) error...what should I try or what am I failing to do properly:

1) I disabled Secure Boot in the BIOS...restart
2) I created a UEFI Shell boot disk using Rufus and the instructions provided on the Mosby Page...I selected/used the UEFI Shell 2.2 25H2 option.
3) I downloaded the latest Mosby zip file...2.7. I extracted it and cut/paste the contents onto the drive...it replaces 7 files (I think) that were originally created by the UEFI Shell process.
4) I start machine, hit the function key to load boot menu, and select the drive...it attempts but fails with error.
5) I also tried booting the drive without copying the latest Mosby files to it...still didn't work.

The only other thing I can think of is that I did see a "clear certificates" option in the BIOS...security tab where I disabled Secure Boot. I was fearful of doing that as I don't know what the consequences are.

Click to expand...

I did this......

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932​

Then I did what is in @Scott #1104 post in this thread.

@Scott #1104

mccmw said:

Will a tutorial be put out for those of us that aren't experts in Secure Boot and certificates? I have (3) older/unsupported devices. Since I barely use the oldest one, I opted to attempt and run Mosby yesterday...no luck. I followed the steps on the Mosby GitHub site...only result was an image security validation error. I'm sure it is operator (me) error...what should I try or what am I failing to do properly:

1) I disabled Secure Boot in the BIOS...restart
2) I created a UEFI Shell boot disk using Rufus and the instructions provided on the Mosby Page...I selected/used the UEFI Shell 2.2 25H2 option.
3) I downloaded the latest Mosby zip file...2.7. I extracted it and cut/paste the contents onto the drive...it replaces 7 files (I think) that were originally created by the UEFI Shell process.
4) I start machine, hit the function key to load boot menu, and select the drive...it attempts but fails with error.
5) I also tried booting the drive without copying the latest Mosby files to it...still didn't work.

The only other thing I can think of is that I did see a "clear certificates" option in the BIOS...security tab where I disabled Secure Boot. I was fearful of doing that as I don't know what the consequences are.

Click to expand...

I don't see the part where you put the BIOS in Setup Mode after turning off Secure Boot? You could probably Clear Certificates providing you also see an option to Reset Factory Keys if Mosby still doesn't work. Security Violations seem to be related to the Platform Key when using Mosby, only way around it is to see if you can clear that key. Some devices may have the PK key locked by the OEM so that you can't override it, more likely on a used corporate business device. From what I've read on the matter, ASUS devices seem play very nicely with Mosby.

mccmw said:

only result was an image security validation error.

Click to expand...

That's because you have Secure Boot enabled. The UEFI Shell is not Secure Boot signed (and cannot be, since it would allow bad actors to install malware), so you need to make sure that Secure Boot is really disabled, or else you won't boot the shell.

As long as you see a security validation error when attempting to boot your media, Secure Boot is enabled, and you need to figure out how to disable it.

The only other thing I can think of is that I did see a "clear certificates" option in the BIOS...security tab where I disabled Secure Boot. I was fearful of doing that as I don't know what the consequences are.

Click to expand...

Well, you will need to do that if you wanna run Mosby. And doing so will disable Secure Boot. So you should do that. If you want to run Mosby, that's the first thing you should do. And this has the nice consequence of also disabling Secure Boot, which you also need if you want to run Mosby. And don't worry, almost every UEFI firmware out there provides an option to restore the keys if you screw up or encounter a problem (and Windows will happily boot with Secure Boot disabled anyway), so you're not going to end up with a Windows that can no longer boot.

mccmw said:

Will a tutorial be put out for those of us that aren't experts in Secure Boot and certificates? I have (3) older/unsupported devices. Since I barely use the oldest one, I opted to attempt and run Mosby yesterday...no luck. I followed the steps on the Mosby GitHub site...only result was an image security validation error. I'm sure it is operator (me) error...what should I try or what am I failing to do properly:

1) I disabled Secure Boot in the BIOS...restart
2) I created a UEFI Shell boot disk using Rufus and the instructions provided on the Mosby Page...I selected/used the UEFI Shell 2.2 25H2 option.
3) I downloaded the latest Mosby zip file...2.7. I extracted it and cut/paste the contents onto the drive...it replaces 7 files (I think) that were originally created by the UEFI Shell process.
4) I start machine, hit the function key to load boot menu, and select the drive...it attempts but fails with error.
5) I also tried booting the drive without copying the latest Mosby files to it...still didn't work.

The only other thing I can think of is that I did see a "clear certificates" option in the BIOS...security tab where I disabled Secure Boot. I was fearful of doing that as I don't know what the consequences are.

Click to expand...

I would do nothing and rely on Windows Updates!

mccmw said:

Will a tutorial be put out for those of us that aren't experts in Secure Boot and certificates? I have (3) older/unsupported devices

Click to expand...

I'm waiting for a WIndows update or an ElevenForum tutorial.

I've been taking note of useful-looking posts on the subject.

It seem to me that garlin has explained what steps are required.
Secure Boot question - useful garlin post #2 - ElevenForum


Denis

Steve C said:

I would do nothing and rely on Windows Updates!

Click to expand...

Or just create a file and name it config.sys , then add the line BUGS = 0,0

man00 said:

Or just create a file and name it config.sys , then add the line BUGS = 0,0

Click to expand...

Please explain that unique suggestion and complete the suggestion by telling us all where we can stick it.


Denis