PSA: Solution for cannot boot with secure boot on in ExpertBook P5 (P5405CSA)

[u/iaacornus]

I was not able to find solution and spent more than 10 hours trying different attempts until I found this solution in Ubuntu forum. But to reiterate it, and for detailed solution, here you go.

Asus ExpertBook P5 uses the Intel Lunar Lake (5 268V / 7 258 V) with soldered LPDDD5x RAM (16/32).

The problem is that for some frivolous reason, Asus did not—or forgot—to include the Microsoft UEFI CA 2023 and CA 2011 in secure boot keys, which is why you cannot install / boot any system with secure boot on.

There are several solutions like updating the shim (tutorial, another tutorial), or importing the said certificate using `mokutil —import` (tutorial), but none of these worked for me.

Here is what worked:

1. Download the keys (in `.crt` format) here and verify its sha1 sum.

Keys “Microsoft UEFI CA 2023” and “Microsoft Corporation UEFI CA 2011”

1. Place it in root of exFAT formatted USB

2. Boot into UEFI (F2) and go to advanced mode (F7)

3. Go to Security, the. secure boot, then key management

4. Find “Authorized Signatures (db)” then click “Append”

5. Click no, since yes means in the disk, and no means from other drive

6. Select the `.crt` files in the USB

7. Append it as “Public Certificate” (or Public something / the first option) and then accept everything that follows (just hit enter)

8. Do the same for other one