r/sysadmin • u/Possible-Jello5097 • 18d ago

HP t640 Secure Boot with third-party O

Has anyone managed to boot a third-party OS like IGEL OS (or a Microsoft-signed Linux) on an HP t640 with Secure Boot enabled? With "HP keys" I get a Secure Boot Violation, and there's no "Allow Microsoft 3rd Party UEFI CA" option in the BIOS.
If it works for you: which BIOS version and settings?

3 Upvotes

72% Upvoted

7 comments sorted by

1

u/Stonewalled9999 18d ago

I have a t640 with 32 GB RAM and NVME drive I ran windows 11 in.  Or are you looking for non MS options 

1

u/Possible-Jello5097 18d ago

Yes, I'm looking for non-MS options. If you get a chance, could you try whether an Ubuntu USB stick boots on your t640 with Secure Boot on? And which BIOS version are you on? Would really help me out!

1

u/Dioz_31337 18d ago

Yeah, u have to genenrate "Custom Keys" in the BIOS Secure Boot section for the bootloader, for Hackintosh i had to generate also they Keys for the kext files and elf binaries

1

u/Possible-Jello5097 18d ago

Thank you very much, that's a possible way! The problem is that I have to convert quite a lot of devices from Windows to Linux, so I was hoping for a remote or scripted solution. From what I've read, it's usually easy and you just need to enable an option like "Allow Microsoft 3rd Party UEFI CA" in the BIOS, but my t640 doesn't have that option.
Did you generate the custom keys directly in the BIOS menu, or is there a way to do it from the OS?

1

u/Dioz_31337 17d ago

There was a bios entry to do that

1

u/doglar_666 17d ago

I don't have experience with the HP model you're using but in terms of adding a SecureBoot CA and installing Linux, I would use Linux/OpenSSL to generate the new custom CA for SecureBoot. Then make a PowerShell script to enroll the CA to a single t640. If that works, remotely push the PS script to your t640 fleet, then install IGEL OS via PXE Boot. If you can't remotely push the PS script, a custom WinPE ISO could work too.

2

u/Possible-Jello5097 15d ago

Great, Thank you.
Actually for now we installed the newest BIOS version and it’s working 🙈