UEFI KEK Certs not updated.

garlin said:

While you're waiting for a response, check the BIOS menus for Secure Boot. Is there an option for manual KEK Key Enrollment?
Your BIOS is probably updated, and will need some manual help.

Click to expand...

The problem with this bios is that it don't have an advanced settings mode, so I can only switch secureboot on and of, I try some key combinations but this bios is locked to basic settings. What I now going to do is ask Huawei how I can unlock this InsideH20 bios to advanced I try a lot of key combinations.
The other question is can I use this laptop in the futere with the KEK certificate not updated or will it get boot problems ? The other certificates are updated.

Without the KEK CA 2023 installed, the other CA 2023 certs aren't actually validated. The UEFI security model is based on a chain of trust, KEK CA 2023 isn't an optional feature. You can have other certs loaded, but they will not be respected.

Huawei PK -> validates KEK CA 2023 -> validates Windows UEFI CA 2023 -> validates CA 2023 boot manager

On some BIOS'es, you must create an Admin password as a security measure to unlock advanced Secure Boot settings.

garlin said:

Without the KEK CA 2023 installed, the other CA 2023 certs aren't actually validated. The UEFI security model is based on a chain of trust, KEK CA 2023 isn't an optional feature. You can have other certs loaded, but they will not be respected.

Huawei PK -> validates KEK CA 2023 -> validates Windows UEFI CA 2023 -> validates CA 2023 boot manager

On some BIOS'es, you must create an Admin password as a security measure to unlock advanced Secure Boot settings.

Click to expand...

Thanks for the information, yes I need all the certificates I understand, I wait what Huawei do with this, I still love this very fast compact notebook I don't want replace it yet.

It’s very annoying and I hope they reply to you. I think some people just turn secure boot off - not ideal I know. I have a couple of old ones that don’t even have secure boot. I suppose they are not used regularly so not particularly at risk. Microsoft released something a couple of weeks ago saying a machine will still boot - it just means they don’t get updates against various boot viruses. It could be that with sensible use and maybe avoiding using usb sticks that have been in other machines - you never have an issue. So your machine wouldn’t be useless if it didn’t get the secure boot certificates - but it’s just a bugbear when you’re in this position.

Presumably installing Linux instead of Windows means not vulnerable to the same issues.

Anyway please let us know what Huswei say - I’d be interested to know.

Hazel123 said:

It’s very annoying and I hope they reply to you. I think some people just turn secure boot off - not ideal I know. I have a couple of old ones that don’t even have secure boot. I suppose they are not used regularly so not particularly at risk. Microsoft released something a couple of weeks ago saying a machine will still boot - it just means they don’t get updates against various boot viruses. It could be that with sensible use and maybe avoiding using usb sticks that have been in other machines - you never have an issue. So your machine wouldn’t be useless if it didn’t get the secure boot certificates - but it’s just a bugbear when you’re in this position.

Presumably installing Linux instead of Windows means not vulnerable to the same issues.

Anyway please let us know what Huswei say - I’d be interested to know.

Click to expand...

Yes I hope the respond, there are a lot users with a D series Matebook with that bios in it.

Cameraman1955 said:

Yes I hope the respond, there are a lot users with a D series Matebook with that bios in it.

Click to expand...

Have you tried running the update script, who knows it might just work? You've got nothing to lose, either it works or it doesn't.

The update script by itself will only work if you have a supported PC (either by BIOS update or submitted KEK to MS). When none exists, the user has to figure out how to access the BIOS menus to enable manual KEK enrollment or deleting all keys. That's the hardest part, not running the script.

Sometimes you need someone who's familiar with this BIOS to explain the proper way to find those settings.

Ok I got am email back from Huawei, the built I have can not be upgraded to KEK 2023 only the later versions of the D14 , the bios upgrade can only with the PC Manager software, but I have the bios 1.19 from 2023 ! So I had an discussion over the mail but don't get any further, the question if I can unlock the bios to advanced mode has not been answered. So now I am looking for other options to update. Otherwise, I'll just have to live with this and leave it.
The good thing is my big desktop computer have all the new certificates.

Cameraman1955 said:

Ok I got am email back from Huawei, the built I have can not be upgraded to KEK 2023 only the later versions of the D14 , the bios upgrade can only with the PC Manager software, but I have the bios 1.19 from 2023 ! So I had an discussion over the mail but don't get any further, the question if I can unlock the bios to advanced mode has not been answered. So now I am looking for other options to update. Otherwise, I'll just have to live with this and leave it.
The good thing is my big desktop computer have all the new certificates.

Click to expand...

Mosby secure boot cert updater

this looks like the only option left
others have used this with great success

this is the Mosby How To which may help

best of luck Steve ..

XxXxX said:

Mosby secure boot cert updater

GitHub - pbatard/Mosby: Mosby – More Secure Secure Boot

Mosby – More Secure Secure Boot. Contribute to pbatard/Mosby development by creating an account on GitHub.

github.com

this looks like the only option left
others have used this with great success

this is the Mosby How To which may help

Usage Instructions | pbatard/UEFI-Shell | DeepWiki

This document provides detailed instructions for using the Mosby tool from within the UEFI Shell environment. Mosby is designed to help users update their UEFI Secure Boot databases, which is particul

deepwiki.com

best of luck Steve ..

Click to expand...

Thank's I am going to read this maybe I can use this.

Regardless of the chosen update method, in order for self-signing to work you must first delete the PK or delete all keys. Which means you still need support to inform you how to access the advanced BIOS menus.

garlin said:

Regardless of the chosen update method, in order for self-signing to work you must first delete the PK or delete all keys. Which means you still need support to inform you how to access the advanced BIOS menus.

Click to expand...

Yes that's why I am searching how to go into the advanced mode of this bios.

Cameraman1955 said:

Yes that's why I am searching how to go into the advanced mode of this bios.

Click to expand...

Have you tried disabling secure boot to see if it will give you additional options in the BIOS?

Yes I did

Dirtyflash said:

Have you tried disabling secure boot to see if it will give you additional options in the BIOS?

Click to expand...

Yes I did give no extra menu's I need to remove the olsd certificates.

Cameraman1955 said:

Ok I got am email back from Huawei, the built I have can not be upgraded to KEK 2023 only the later versions of the D14 , the bios upgrade can only with the PC Manager software, but I have the bios 1.19 from 2023 ! So I had an discussion over the mail but don't get any further, the question if I can unlock the bios to advanced mode has not been answered. So now I am looking for other options to update. Otherwise, I'll just have to live with this and leave it.
The good thing is my big desktop computer have all the new certificates.

Click to expand...

I'd email again specifically asking them to let you know how to unlock the bios to advanced mode saying that question wasn't answered before and you need to know. Worth a try.

Just out of interest, what does it say in Device Security under secure boot? ie what message is there?

With the June 2026 update, non-compliant PC's now get a warning which directs you to check with your PC manufacturer for help.

garlin said:

With the June 2026 update, non-compliant PC's now get a warning which directs you to check with your PC manufacturer for help.

Click to expand...

That seems useless in his case, he's already done that!

I was just thinking about what kind of risk users face with laptops that still have the old KEK 2011 certificate; if well-known brands stop updating the firmware of 4 or 5-year-old laptops, surely a problem arises. Laptops that run Windows 11 perfectly fine and still function very well aren't replaced quickly. Another question is how you can properly protect yourself against root and bootkits on these laptops. Anyway, we'll keep looking for a good solution, or otherwise I have to get a new laptop :-(

This is what many users are seeing with older firmware, I'm curious how many people on the forum are experiencing this message as well.

According to AI (which is unreliable), Huawei laptops don't have any kind of method of unlocking advanced bios, other than setting a supervisor password to unlock various things. Shut down, boot into bios with F2 key, go to "Security" tab, select "Set Supervisor password" (or set Administrator password), and hit enter. Create a memorable password (and write it down), press F10 to save changes. Restart and do F2 to go into bios again and enter the password if requested, go back to the Security or Boot tab. The hidden Secure Boot key Management, Custom mode, or restore factory keys options should be visible and selectable.

Maybe? Could be worth a try. I had to do that on a laptop once and it did unlock various things.

I'm also wondering if clearing the CMOS battery might reset the bios or bring up new options. It was something that was needed to clear bios passwords on older laptops - in those days you could use two points of a paperclip on a couple of contacts next to the cmos battery. Not sure how you'd do it now, other than maybe a hard reset.

There's also this for restoring default bios generally - but you probably already know this

Another question is how you can properly protect yourself against root and bootkits on these laptops.

Click to expand...

You could just turn secure boot off, use any highly rated antivirus program plus Malwarebytes Premium which detects rootkits and bootkits. Or just use Malwarebytes premium. And occasionally run the Kaspersky offline rescue disk (to check everything is clean - it detects rootkits or bootkits before windows loads). Once you have the Kaspersky rescue disk burned to usb it's fairly simple and quick to use on occasion - except it seems to need an ethernet connection to be able to update each time.

With sensible internet use and an adblocker you'd maybe never have an issue - and don't use usb sticks that have been in another machine. And maybe encrypt your drive and use strong WPA3 passwords on router. All of which are sensible anyway. I would think phishing emails would be a risk so care to avoid clicking on links in emails (sensible anyway) and some AV's actually protect from phishing emails now and alert you also.

And set a bios password.