ThinkPad CBA: BIOS certificate authentication

Certificate-Based BIOS Authentication (CBA) is Lenovo’s certificate-based method of protecting administrative BIOS access instead of using a supervisor password. This guide explains the one-time code, why some CBA prompts have no QR code and what to establish before buying or handing over a device.

How CBA differs from a supervisor password

A supervisor password, or SVP, protects administrative access to UEFI / BIOS with a password. With CBA, an enrolled digital certificate takes that role. Authorised changes are signed using the corresponding private key and verified by the device. Lenovo describes the method as a way to manage BIOS settings without exchanging a password in plain text.

For access directly at the device, IT can provide a one-time unlock code. This allows a technician to gain access without receiving a permanently reusable administrative password. A restart requires fresh request data and a new code.

The certificate and private key are separate parts. The certificate is enrolled on the device. The responsible IT team retains the matching private signing key. Copying the visible certificate information does not replace that key.

When was CBA introduced on ThinkPads?

Lenovo documents CBA from the 2022 ThinkPad model year. Compared with the traditional supervisor password, it is a newer feature that we have encountered less often in our service work so far. Premium ThinkPads from the Intel 12th-generation and AMD Ryzen PRO 6000 era, such as the ThinkPad Z13 Gen 1, provide a useful starting point. Availability depends on the specific model and firmware, not on CPU generation alone.

In our view, CBA will become more relevant to used devices as these corporate fleets enter the second-hand market.

Which certificates exist, and does the BIOS password remain?

Lenovo distinguishes Supervisor Certificate and, on suitably equipped newer devices, System Management Certificate. They serve different administrative roles. Not every model supports both certificates.

For the same administrative role, the certificate replaces the password. A supervisor certificate and supervisor password therefore do not operate as two alternative access methods at the same time. This does not remove every other password: a power-on or drive/NVMe password may still be set. Those protections are not additional CBA certificate types.

QR codes, request data and unlock codes

A CBA prompt displays request data as a QR code or a longer hexadecimal block. The data can also be provided as an exported text file on a USB drive. The responsible IT team uses the matching private key to retrieve the multi-character unlock code for that request. The request data and unlock code are therefore different things.

The unlock code is a one-time password. Lenovo limits its validity to the current logon prompt within the same power-on cycle and to a maximum of two hours. A restart requires a new request and code; a previously saved code does not become valid again.

In our service work, we have encountered the ThinkPad Z13 Gen 1 displaying a hexadecimal block instead of a QR code in its CBA prompt. On the device we checked, this presentation remained unchanged after a BIOS update. This is an observation from that model and does not rule out CBA. A photograph of the complete screen is therefore useful when making an enquiry.

An unlock code for access does not automatically remove the enrolled certificate. Access, administrative authority and permanent release for handover should be checked separately.

Contact the responsible IT team first

For a managed company device, internal IT is the first point of contact. The team can check which certificate was enrolled and whether the matching key is available. Lenovo provides the Lenovo BIOS Certificates Tool and supporting documentation.

The standard route is through authorised administration. If the private key is missing, an unrelated certificate is not a replacement. Knowing the previous supervisor password does not simply restore administrative access while certificate mode is active.

Do not send private signing keys or BitLocker recovery keys in a service enquiry. For an initial assessment, we need device details and the exact screen, rather than those credentials.

Document release before sale or retirement

The new responsible party should be able to administer the device after handover. Before a sale, lease return or transfer, establish:

Is a supervisor or system management certificate enrolled?
Which IT team can manage it and carry out the agreed release?
Has the resulting state been checked and recorded against the correct device?
Have other matters, such as storage and device management, been handled separately?

Our checklist for used ThinkPads provides a short incoming inspection process. For bulk orders, the guide to device batches helps with identification and preparation.

CBA is not drive encryption

CBA concerns authentication for BIOS administration. BitLocker encrypts drive data. A BitLocker recovery key is not a CBA signing key. A CBA unlock does not decrypt an SSD or deregister a device from Intune or Windows Autopilot.

This distinction also matters when shipping a device: back up your data and prepare storage as described in our guide to data and shipping.

If the previous administrator cannot release access

Our ThinkPad unlock service accepts enquiries about SVP and CBA locks. We use an independently developed method. We establish the specific service scope from the device; this article does not describe internal procedures or promise support for every model.

Send us the model, generation, MTM and complete prompt through our contact page, or submit a CBA unlock service request directly. Include whether the device starts, known damage and previous interventions. You must be the lawful owner or duly authorised to commission the service. We then agree shipping arrangements with you.