Secure Boot certificates

WHY.A.H.WHY.A

SN: D58003FF40135
SER5 PRO-E-16500EJ0W64PRO-D
x2 HDMI Ports
BIOS Version/Date 5800H502, 2/15/2023

Hi, I’m getting this entry in my event viewer, anything to be done from my side, I checked msinfo32 and it says secure boot state - OFF i can’t recall disabling it

Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:AZW;FirmwareManufacturer:American Megatrends International, LLC.;FirmwareVersion:5800H502;OEMModelNumber:SER;OEMModelBaseBoard:SER;OEMModelSystemFamily:Default string;OEMManufacturerName:AZW;OEMModelSKU:Default string;OSArchitecture:amd64;
BucketId: 24279df41b0a60206485ffa70e7a598136c24af77a4d3985f1aead1b44e8f697
BucketConfidenceLevel: Under Observation - More Data Needed
UpdateType:
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.

WHY.A.H.WHY.A

Any help will be appreciated.

Beelink CS-June

WHY.A.H.WHY.A

Hello there,

Your machine’s BIOS version is the lastest.

Please try this tutorial to solve the problem: https://buildin.ai/lizong/share/262ce514-3f67-4324-8127-9962a33b1d4d

The security certificate update for Windows can be resolved by attempting the March Windows update and then installing the latest version of Windows 11 PRO.

Have a nice day~

WHY.A.H.WHY.A

I tried to enable secure boot but it’s giving me the following message:

"System in Setup Mode

Secure Boot can be enabled when System in
User Mode Repeat operat ion after
enrolling Platform Key(PK)

Beelink CS-June

WHY.A.H.WHY.A

Hello there,

We have already passed your issue on to the developers for their attention.

At present, the problem with your machine requires the installation of a new BIOS.

We will contact you as soon as we receive the BIOS provided by the R&D team.

Have a nice day~

jamar23

Hello,
I believe I have a similar situation going on here as well with regards to the BIOS 2023 certs but on the SER8 8845HS:

System- SER8 8845HS S/N: B88455HF80235 OS:Win11 25H2
BIOS: V035.P8C0M0C15.14

(This was the latest BIOS as found on the support page at the time and used because there was no Secure Boot option with the original BIOS received with the unit.)

My system has gotten a little farther with regards to installing the 2023 Certs and Boot Manager. I have forced, via registry update, to have the boot 2023 Certs installed as indicated by the Event log ID 1808 posted below. Unfortunately, it has not progressed past this point to update the bootmgfw.efi files. The Event IDs 1044 and 1045 have occurred, but none of the Event IDs 1043,1034 and 1799 have occurred. The bootmgfw.efi is still signed only by the 2011 cert or the Event ID 1799 would be logged. I have attached the Event ID 1808 full details below which still states that the final updates are “Under Observation - More Data Needed”. According to the Microsoft data, this indicates that the BIOS could be holding up the update. Is the BIOS still holding up the updates, or is Microsoft holding up the update because the SER8 BIOS is not on the approved list yet? Any direction on how to proceed would be appreciated, because I would assume others are going to have this issue as well.

Kind regards 😉

Log Name: System
Source: Microsoft-Windows-TPM-WMI
Date: 4/14/2026 4:11:15 PM
Event ID: 1808
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer:
Description:
This device has updated Secure Boot CA/keys. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:AZW;FirmwareManufacturer:American Megatrends International, LLC.;FirmwareVersion:HPT.8xxx.SER8.V035.P8C0M0C15.14.Link;OEMModelNumber:SER8;OEMModelBaseBoard:SER8;OEMModelSystemFamily:SER8;OEMManufacturerName:AZW;OEMModelSKU:75;OSArchitecture:amd64;
BucketId: 244d5eee7d18f2b35e3ea073932c43bdd736df0b5341e73b5c213719a9ff830a
BucketConfidenceLevel: Under Observation - More Data Needed
UpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.

Beelink CS-June

jamar23

Hello there,

I have sent you the corresponding BIOS file, please check your PM.

Please try to update the BIOS to solve the problem.

Have a nice day~

TEK

Hello,
I also get the TPM error. I could not find a bios update for my model in the beelink blog at https://www.bee-link.com/blogs/all/bios-update-summary-for-q1-2026. Is one available for the the SER5 Pro?

Log Name: System
Source: Microsoft-Windows-TPM-WMI
Date: 7/11/2026 1:01:21 PM
Event ID: 1801
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: DESKTOP-QF76PPF
Description:
Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:AZW;FirmwareManufacturer:American Megatrends International, LLC.;FirmwareVersion:SER5H512;OEMModelNumber:SER;OEMModelBaseBoard:SER;OEMModelSystemFamily😃efault string;OEMManufacturerName:AZW;OEMModelSKU😃efault string;OSArchitecture:amd64;
BucketId: 5ffbad62d3f12d5760593e0501fa90df12330b6c35c143d0fb551e17184be64e
BucketConfidenceLevel: High Confidence
UpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.

Beelink CS-June

TEK

Hello there,

I have sent you the lastes BIOS file, please check your PM.

Have a nice day~

donut

@Beelink CS-June

I am requesting assistance and, if available, a corrected production BIOS from your R&D team for my Beelink EQ / EQi12 system.

DEVICE INFORMATION

Product family: Beelink EQ / EQi12
DMI product name: EQ
DMI board name: EQ
System vendor: AZW
Board vendor: AZW
Serial number: [REDACTED! Available privately to Beelink support.]
Processor: 13th Gen Intel Core i5-13420H
Installed memory: 16 GB
BIOS vendor: American Megatrends International, LLC.
BIOS version: EQI12403
BIOS date: 04/09/2026
Intel Management Engine firmware: 16.1.27.2225
Operating system: Ubuntu 24.04 ×86_64
Kernel: 6.8.0-137-generic
TPM: TPM 2.0
Boot mode: UEFI
Secure Boot: Enabled
VT-d/IOMMU: Enabled and operational

BIOS SETTINGS ALREADY CONFIGURED

I have configured every applicable security setting exposed by the current BIOS:

Secure Boot enabled
UEFI-only boot enabled
CSM disabled
Fast Boot disabled
TPM/PTT enabled
VT-d enabled
BIOS Lock enabled
Hibernation disabled
Legacy S3 suspend disabled
Firmware Update enabled
ME Firmware Image Re-Flash disabled

These changes successfully produced the following results:

SPI writes are disabled.
SPI lock is enabled.
The SPI BIOS region is locked.
UEFI boot-service variables are locked.
Platform debugging is disabled and locked.
IOMMU is enabled and functional.
Secure Boot is enabled.
TPM PCR0 reconstruction is valid.
Legacy suspend-to-RAM is disabled.
Linux kernel lockdown is enabled.

REMAINING FIRMWARE-LEVEL SECURITY FAILURES

The current BIOS continues to report the following failures through fwupdmgr Host Security ID validation.

HSI-1:

BIOS firmware/capsule updates: Disabled or unsupported
CSME manufacturing mode: Unlocked
SPI BIOS descriptor: Invalid
UEFI Platform Key: Invalid

HSI-2:

Intel Boot Guard ACM protection: Invalid
Intel Boot Guard OTP fuse configuration: Invalid
Intel Boot Guard verified boot: Invalid

HSI-3:

Intel Boot Guard error policy: Invalid
Pre-boot DMA protection: Disabled
Suspend-to-idle/S0ix: Disabled or not correctly exposed

HSI-4:

Encrypted RAM: Not supported

SECURE BOOT PLATFORM KEY

Secure Boot is operational according to the operating system, but the firmware Platform Key is identified as invalid.

Inspection of the firmware-provided PK and PKDefault indicates that they appear to contain an expired AMI test Platform Key labeled similar to:

DO NOT TRUST - AMI Test PK

This does not appear to be a valid Beelink/AZW production Platform Key.

I have not restored the BIOS factory Secure Boot keys because I do not want to replace the currently working key configuration with expired AMI test material.

MISSING BIOS CONTROLS

The current BIOS does not expose usable settings for:

UEFI capsule firmware updates
Pre-boot DMA protection
Early DMA-remapping policy
Thunderbolt or USB4 preboot security
Thunderbolt or USB4 PCIe-tunnelling policy
Modern Standby or S0ix selection
Intel Boot Guard provisioning
CSME manufacturing-mode closure
SPI descriptor correction

REQUEST TO THE R&D TEAM

Could you please ask the firmware or R&D team to provide or confirm the following?

A production BIOS specifically approved for this exact model, board revision, and serial-number range.
A valid production Secure Boot key set, including the Platform Key, KEK, db, and current dbx.
Support for the Microsoft UEFI CA 2023 certificate transition, where applicable.
A corrected and locked SPI flash descriptor.
CSME provisioning with manufacturing mode permanently closed.
Correct Intel Boot Guard provisioning, including ACM protection, verified-boot enforcement, OTP/fuse configuration, and a secure error policy.
Authenticated UEFI capsule firmware-update support through fwupd/LVFS or another supported mechanism.
Pre-boot DMA protection and DMA remapping before untrusted external devices can perform DMA.
Proper S0ix or Modern Standby exposure, if this hardware supports it.
Confirmation of whether the Boot Guard, CSME, and SPI descriptor findings can be repaired through a BIOS update.

If any of these findings result from immutable factory fuse or provisioning errors and cannot be corrected through firmware, please advise whether the motherboard requires replacement.

INFORMATION REQUIRED BEFORE INSTALLING A BIOS

This system uses full-disk encryption and TPM-sealed credentials. Before installing a supplied BIOS, please confirm:

The BIOS is specifically compatible with serial number [REDACTED! Available privately to Beelink support.].
The exact supported update procedure.
Whether the update changes TPM PCR measurements.
Whether the update clears or resets the TPM.
Whether the update clears Secure Boot variables or enrolled keys.
Whether the update restores the AMI test Platform Key.
Whether the update resets BIOS settings.
Whether disk-encryption recovery credentials will be required afterward.
Whether BIOS rollback is supported.
The safe rollback procedure, if supported.
Whether the firmware image is production-signed.
The expected SHA-256 digest of the firmware package.
The BIOS version that should appear after installation.

Please do not send firmware intended only for a similar-looking model unless R&D has confirmed that it is compatible with this exact board and serial-number range.

I can provide the following privately if required:

Complete fwupdmgr security output
fwupdmgr security JSON evidence
BIOS setup photographs
Secure Boot certificate and variable information
TPM PCR measurements
DMI information
Linux boot logs
Any diagnostic package requested by your R&D team

Please let me know whether corrected firmware is already available or whether this case needs to be escalated to the firmware engineering team.

Thank you for your assistance.

Kind regards

Franklin

Olá, preciso atualizar
meu mini pc para o CA2023

Beelink CS-June

Franklin

Hello there,

Please repeatedly press delete key as soon as you turn on the PC, go to BIOS. Please send us a picture of the Main page, we will check if you need to update the BIOS.

Have a nice day~

donut

Hello there,

Could you please send us a picture of SN code(two lines) at the bottom of machine?

Could you please take a picture of the BIOS main screen of your machine for us to see?

Then we can help you better.

Have a nice day~

Franklin

Aqui não deixa carregar imagem maior de 120kb, nem a minha maquina fotográfica de 10 anos tira foto nesse tamanho. por isso não consigo carregar nenhuma foto.

Franklin

Beelink CS-June Aqui não deixa carregar imagem maior de 120kb, nem a minha maquina fotográfica de 10 anos tira foto nesse tamanho. por isso não consigo carregar nenhuma foto.

Franklin

Beelink CS-June Mas para ver se conseguimos algo aqui, o SN: BN1003BH81108 EQ12-A-16512SD0W64PRO-BC/XB
E a data da BIOS é Version: N95V104 2.22.1288 03/14/2023

Beelink CS-June

Franklin

Hello there,

Thanks for your reply~

I have sent you the lastest BIOS file, please check your PM.

Please try to update the BIOS and solve the problem.

Have a nice day~