For EliteBook 840 G6 we have published BIOS version 01.35.02 (sp173290) which allows Microsoft adding the 2023 certificates on this system. For EliteBook 840 G5 (and older systems) which have reached end of service date there's an update package available which manually adds all the 2023 Secure Boot certificates to the KEK and db database. Please keep in mind the this package does not update the default databases. Please contact HP Support to receive the update package.

For a list of platforms that have updated BIOS support, please see https://support.hp.com/us-en/document/ish_13070353-13070429-16 for the "HP Business PCs - Prepare for new Windows Secure Boot certificates" article. In particular, see the "List of supported HP Commercial PCs released between 2018 and 2023 and minimum BIOS version" section.

For the HP EliteBook 840 G6, BIOS version 01.33.00 is available from https://ftp.hp.com/pub/softpaq/sp162501-163000/sp162942.exe

Where possible, the latest BIOS posted on https://www.hp.com should be used.

https://ftp.hp.com/pub/softpaq/sp173001-173500/sp173290.exe

sp162942 added support to enable Windows to append the 2023 UEFI CA certificates to the UEFI DB. 

sp173290 added support for new BIOS policies that enable selecting specific certificates to be included in the UEFI DB. 

For select older platforms like the HP EliteBook 840 G5, see the "Support for HP Commercial PCs outside of service life" section. HP support can provide a script upon request to append the UEFI CA 2023 certificates to the UEFI DB for older platforms, such as the HP EliteBook 840 G5.