Scripts that I tried.
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match "Windows UEFI CA 2023"
If it returns True, your EliteBook is successfully configured with the new certs and you are completely safe ahead of the 2011 CA expiration window. If it returns False, the certificate hasn't been written to the UEFI NVRAM yet.
Force
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x40 /f
Force Windows to execute the update task immediately:
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
Reboot the laptop twice. If you get an Error 1802 or a block notice in your Event Viewer (under Applications and Services Logs > Microsoft > Windows > SecureBoot), it means the BIOS version currently on your machine is still too old to accept the 2023 key, and you will need to pull the absolute newest firmware package from the HP FTP/driver site first.