HCL - Lenovo Thinkpad X1 Carbon 4th gen (20FB)

[Jean-Philippe Ouellet]

A few notes:

The 4.1 kernel R3.1 ships with is not usable due to graphics issues on
resume. Update with the unstable repo or use 3.2.

I am booting in UEFI mode, and had to follow the advice of
https://www.qubes-os.org/doc/uefi-troubleshooting/ in order to get the
4.4 kernel to boot. This was *very* time consuming to find out the
hard way.

The internal disk is an NVMe device, and appears to just be supported,
no problem.

Wireless works with 4.4 kernels and seems stable.

Graphics, audio, and wireless all appear to continue to work after
suspend/resume so far.

I have not had the machine long enough to have a confident idea of
battery life yet, but the 4th-gen x1 runs hotter while completely idle
than my 1st-gen x1 does while playing music and doing light disk/net
i/o, so there must be room for improvement. More recent kernels should
improve things, but I have yet to try.

I was on a 1st-gen (3443) x1 carbon before and had the screen go
permanently-white (but works when plugged into an external monitor).
That was running Qubes just fine too (although 8gb ram was a little
tight for my level of compartmentalization). Infuriating-to-discover
UEFI issue aside, the 4th-gen x1 carbon seems like a good upgrade.
They removed the dedicated volume buttons, hardware r/f kill switch,
and dropped down to a single USB controller (keyboard still not on
USB, thankfully), but otherwise it's a rather similar device.

I'll have to use it for a while before I'm willing to recommend it for
Qubes, but so far it seems like a decent option.

[equ...@icloud.com]

Can you let me know how things function under 3.2? Any improvements? I am keen to get the X1 4th generation but I want to make sure it has full Qubes compatibility since that will be it's primary purpose.

[Jean-Philippe Ouellet]

On Wed, Oct 12, 2016 at 8:17 PM, <equ...@icloud.com> wrote:
> Can you let me know how things function under 3.2? Any improvements? I am keen to get the X1 4th generation but I want to make sure it has full Qubes compatibility since that will be it's primary purpose.

3.2 is no different from 3.2-rc3 from an x1 hardware-support perspective.

Some things I've discovered since my original post:

The laptop fails to resume about once a day and requires a
hold-the-power-button reset. So far this has not caused any corruption
that I've noticed (perhaps I'm just lucky) and has been only mildly
annoying (or more-than-mildly annoying when forced to re-type my disk
password in a not-so-private environment as a side-effect of
rebooting).

I'm hoping that newer kernels fix this (dom0 currently on 4.4.14-11),
but I have yet to get around to actually trying it. Unfortunately I
have more pressing things to work on than rebasing the qubes kernel
patches and rebooting all day. Perhaps I'll get around to it some
weekend in the not-so-distant future if somebody doesn't beat me to
it...

Battery life for normal browsing, text editing, and the occasional
compile seems to be roughly 6-8 hours.

The super-high-dpi screen IMO turned out to actually be rather
annoying due to insufficient maturity of high-dpi support and my eyes
not having built-in magnifying glasses, so I'm running it at
globally-reduced resolution (scaled w/ xrandr in dom0). That's kinda
lame, but oh well.

Overall I would recommend it. It's been my primary machine for the
past few weeks. Support is good enough right now, and will only
improve with time.

[Jean-Philippe Ouellet]

If you're going to get one, I'd say definitely go with 16gb ram, and
know that NVMe vs traditional SSDs appear to be equally well
supported.

The idea of a WWAN module (w/ accompanying free-to-do-whatever
baseband) in a laptop is a scary proposition and highly
un-recommended, and so are the vPro-labeled NICs (because AMT) but it
appears you can't get the model with the fastest processor without
one. You can "permanently disable AMT" via a bios option, but in
reality who knows if that actually means anything.

A note about placing orders: be sure that you haven't inadvertently
selected a back-ordered component. The order page lead time should say
5-7 days. If it says 10-12 days, they're lying, that's just their
hard-coded "longer than 5-7 days" time. I had a >1 month delay due to
the disk (which I only found out by contacting support after 12 days
and asking wtf was up), and I ended up canceling my order and placing
a new one with different components. (Or perhaps my delays were simply
because the [A-Z]{3} interdiction and implanting facility had a
backlog of work to do... who knows ^_^)

[Jean-Philippe Ouellet]

Also, here are the hashes of the files I used to update my BIOS to
1.18 without ever booting windows following the procedure described
here: http://www.floccinaucinihilipilification.net/blog/2011/10/2/updating-the-bios-of-a-thinkpad-x220-using-linux.html

$ sha256sum geteltorito.pl x1carbon-bios-1.18/*
378a6305edb9397978e60b7908a85dd8c2546f2808cb845552d5e4a8ba9baab3 geteltorito.pl
0e13111e41f0ae79c0941865ee9647a19b698368ae71d1fca81f35a837463b85
x1carbon-bios-1.18/n1fuj12w.exe
c10ed88917a7f8779059a07e9f517b925a2ba714040518f019293728bbe4b0eb
x1carbon-bios-1.18/n1fuj12w.txt
e15fa987b0285254519cfb755667d7174374c75b1323343f69f9fc0670bc875f
x1carbon-bios-1.18/n1fur12w-extracted.img
eb08c3723293d82dd5f0f953de16d7f995b70b4abc6c7ab9144b620941a658f8
x1carbon-bios-1.18/n1fur12w.iso
bebf6bce6ff99ed66737f6fbad958f949a06b3df7173941ff6062f76c7c2f8e3
x1carbon-bios-1.18/n1fur12w.txt

If you get an x1 and yours differ I would *really* like to know!

[Jean-Philippe Ouellet]

tl;dr - kernel-4.8.7-11 +1 from me!

On Thu, Oct 13, 2016 at 1:20 AM, Jean-Philippe Ouellet <j...@vt.edu> wrote:
> The laptop fails to resume about once a day and requires a
> hold-the-power-button reset

> I'm hoping that newer kernels fix this (dom0 currently on 4.4.14-11),

Since last Friday (~3 days) I've been on kernel-4.8.7-11 from
qubes-dom0-testing with only a single full-fan hang while attempting
to resume (not the usual failure mode, and *much* less frequent), as
opposed to the several-per-day just-dead hangs I was consistently
experiencing before, so... progress! :)

Wireless[1] now sometimes fails to come back after resume with this in
the dmesg:
Freezing user space processes ... (elapsed 0.001 seconds) done.
Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done.
PM: freeze of devices complete after 0.090 msecs
suspending xenstore...
PM: late freeze of devices complete after 0.053 msecs
PM: noirq freeze of devices complete after 21.827 msecs
xen:grant_table: Grant tables using version 1 layout
PM: noirq thaw of devices complete after 0.648 msecs
PM: early thaw of devices complete after 0.089 msecs
PM: thaw of devices complete after 0.453 msecs
Restarting tasks ... done.
IPv6: ADDRCONF(NETDEV_UP): wlp0s0: link is not ready
iwlwifi 0000:00:00.0: L1 Enabled - LTR Enabled
iwlwifi 0000:00:00.0: L1 Enabled - LTR Enabled
iwlwifi 0000:00:00.0: Failed to load firmware chunk!
iwlwifi 0000:00:00.0: Could not load the [0] uCode section
iwlwifi 0000:00:00.0: Failed to start INIT ucode: -110
iwlwifi 0000:00:00.0: Failed to run INIT ucode: -110
iwlwifi 0000:00:00.0: L1 Enabled - LTR Enabled
iwlwifi 0000:00:00.0: L1 Enabled - LTR Enabled
iwlwifi 0000:00:00.0: Failed to load firmware chunk!
iwlwifi 0000:00:00.0: Could not load the [0] uCode section
iwlwifi 0000:00:00.0: Failed to start INIT ucode: -110
iwlwifi 0000:00:00.0: Failed to run INIT ucode: -110
....

Rebooting sys-net (so far) reliably makes it work again (and man... I
really wish there were some way to restart it without shutting
everything else down first - it'd be awesome if sys-firewall would
gracefully re-establish whatever it needs. idk what that would be
exactly, or what the challenges are - i haven't looked under the hood
of qubes networking yet).

Curiously, the wireless didn't hang while i had the 4.4 kernel in
dom0, and now it hangs with 4.8 in dom0 and either 4.4 OR 4.8 in
sys-net. This does not make sense to me, but it is indeed what I have
observed. Perhaps it was also failing before and I just never noticed
because the whole machine would hang so often.

[1]: lspci => 00:00.0 Network controller: Intel Corporation Wireless
8260 (rev 3a)

[Jean-Philippe Ouellet]

On Mon, Nov 14, 2016 at 2:02 AM, Jean-Philippe Ouellet <j...@vt.edu> wrote:
> kernel-4.8.7-11 from qubes-dom0-testing

Err, that should be qubes-dom0-unstable.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You can temporarily set sys-firewall netvm to none. This will allow you
to shutdown/restart sys-net without consequences. Remember to change
sys-firewall netvm back to sys-net afterwards.

> Curiously, the wireless didn't hang while i had the 4.4 kernel in
> dom0, and now it hangs with 4.8 in dom0 and either 4.4 OR 4.8 in
> sys-net. This does not make sense to me, but it is indeed what I have
> observed. Perhaps it was also failing before and I just never noticed
> because the whole machine would hang so often.

I'd guess the later... When it hangs, does the suspend before takes
usual not-so-long time, or is significantly longer?

> [1]: lspci => 00:00.0 Network controller: Intel Corporation Wireless
> 8260 (rev 3a)

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYKimzAAoJENuP0xzK19csTdMH/iSFWVihOXWVvpaY1743SFYR
ODmahDetFwdgPdcRCun8190uP0c0MsE8CCqZOT5EMqnGD3EdVSFYx/zU3yG+Yi6b
3dY1kBcL0jS5ANk1i8DaYis/U5USxHmWHJ4pWkIqiC/u3ErruyUW80hXaHF73QDf
9agjnjSudidbbD7p/3J3BqD7cW9APUEoqPjvTgsrrdEOvc3tKFK6yfYE3WktGhee
rbnImBhsjwWz1nR3YsS5tCwmqMBCRfgOqo5sZc5K1lbzrc0d1/ZNKaUGf8lQXE9X
S7LYhVBzMMLZAfo13Y/bPYupmOdXqxAqMU6O0KOZ85QQzyvYUFNEf9RwYF+hbsc=
=Fo4R
-----END PGP SIGNATURE-----

[Jean-Philippe Ouellet]

On Mon, Nov 14, 2016 at 4:16 PM, Marek Marczykowski-Górecki
<marm...@invisiblethingslab.com> wrote:
> You can temporarily set sys-firewall netvm to none. This will allow you
> to shutdown/restart sys-net without consequences. Remember to change
> sys-firewall netvm back to sys-net afterwards.

Good to know! I wish I'd thought of that earlier :)

>> Curiously, the wireless didn't hang while i had the 4.4 kernel in
>> dom0, and now it hangs with 4.8 in dom0 and either 4.4 OR 4.8 in
>> sys-net. This does not make sense to me, but it is indeed what I have
>> observed. Perhaps it was also failing before and I just never noticed
>> because the whole machine would hang so often.
>
> I'd guess the later... When it hangs, does the suspend before takes
> usual not-so-long time, or is significantly longer?

Assuming you mean "when the wireless card attached to sys-net appears
to hang, does immediately prior overall system resume appear to take
longer?" then I have not noticed that to be the case. I will try to be
more aware of that in the future.

What do you suspect that makes you ask this?

[Jean-Philippe Ouellet]

I found it hung again today with pulsing power button and no 100% fans
this time to alert me to suspend problem (just a hot backpack). The
old failure symptoms appear still present, but nowhere near as
frequent.

I'm honestly surprised I still haven't noticed any problems due to
file-system corruption. :)

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

When suspending the system, dom0 ask each VM having any PCI device to
suspend itself (properly suspending the device etc). But there is a
timeout (AFAIR 30s) after which VM is simply paused. In that case, the
device/driver after resume most likely will be confused... In some cases
it reset the device and work just fine, in other cases driver reload is
needed, or even VM restart.

- - --

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYK5PbAAoJENuP0xzK19csk2UH/AyXaXCdIRa8a9y0so5ZQjkB
KijrMe6gn0zEZcQ3eFBLsSsHEl1wvN3tzY3uV/TA8iAzG3PhZ76Edcp6p7Nrifzp
Cg+AtDGUk1oPJIQDLUIbEtyDAQztfy8HfYMHviS+HmqH6zL3DGUYO2D/10zaXrhu
TTImi9EpSMMC2Z+LZGEtLf0fyFGZwvK3g5bN+Dzesav6EWNnku4uvw9PJgNtJFKb
TVqcGh7Aqn7gyC1/ZpMHO9bevXsQ7A8Y5X05B4k5ptnghUWq3U/Z5qTHBAxsEILP
XVp8x9SGRTMwib2Fi2HT4i8P26Y0M5bo/wGKrvZXKP5P/UPcsB+zf3tm5o2npqY=
=pGQ0
- -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYK5R8AAoJENuP0xzK19csuaIH/0Wxb0SyDtOsw/IzE57vbAeA
eKEBZcmK3i62iziHzLVX/Jnx72orPLH2rzFl9mQkeGmV+iqgmeQTcQSe5XHhJrjX
xVfr5RqbFHEDK9pED22BvQI2biFt+L0HGyWQuTcDsQneXUMNBZldFKcrIJ/sPZ+Z
e4FF42WLLwmXSa8aS8DMlcRQWLjoH3pgnhiSzNAYyTDCDeB9xWwzmsFClfP4RgAR
0pR4OW28439F/9EjUJR3fYymbi5CV/c8MLqUiniOTEr9FW1mn3Nr/rPaVXlzhnMJ
y1hk97dl9wQRalTJEBwoXF+Wo1jqovIx9IaiGU2B3y8ao332yCAVa+qP+FPIUss=
=wNCY
-----END PGP SIGNATURE-----

[Jean-Philippe Ouellet]

In the interest of maximizing list archive utility, I'm attaching a
new HCL here (bumped kernel to 4.8.12-12 & xen to 4.6.4).

I still have issues with suspend/resume. Sometimes it fails to resume,
and sometimes it fails to suspend (leading to a hot backpack and/or
quickly dead battery).

There is now another HCL of the same laptop here [1] which claims that
kernel 4.8.12-12 fixes the suspend-resume issues, but this has not
been the case for me.

[1]: https://groups.google.com/forum/#!msg/qubes-users/kLlBahlTRK0/rInkUwa0FAAJ

[Holger Levsen]

On Sun, Feb 26, 2017 at 02:56:53PM -0500, Jean-Philippe Ouellet wrote:
> In the interest of maximizing list archive utility, I'm attaching a
> new HCL here (bumped kernel to 4.8.12-12 & xen to 4.6.4).
>
> I still have issues with suspend/resume. Sometimes it fails to resume,
> and sometimes it fails to suspend (leading to a hot backpack and/or
> quickly dead battery).

what are your exact symptoms? mine are: suspend works nicely, but no resume
(no reaction at all in fact) once I press the keys to wake up my machine,
which is a X260, also skylake, also 4.8.12 + xen 4.6.4.

-> this doesnt happen always, but around 20% of the time or so. Pretty often.

I think we should file an issue in the "real" tracker… (or is there one
already? I think I tried searching for one, but didnt fine any…)

I'd also be glad to try a 4.9 or 4.10 based kernel…


--
cheers,
Holger

[Chris Laprise]

Do either of you use anti-evil-maid? That, with recent versions of Xen,
seems to be one of the triggers for this behavior.

Chris

[Jean-Philippe Ouellet]

On Mon, Feb 27, 2017 at 3:42 PM, Chris Laprise <tas...@openmailbox.org> wrote:
> On 02/27/2017 03:11 PM, Holger Levsen wrote:
>> On Sun, Feb 26, 2017 at 02:56:53PM -0500, Jean-Philippe Ouellet wrote:
>>> I still have issues with suspend/resume. Sometimes it fails to resume,
>>> and sometimes it fails to suspend (leading to a hot backpack and/or
>>> quickly dead battery).
>>
>> what are your exact symptoms? mine are: suspend works nicely, but no
>> resume
>> (no reaction at all in fact) once I press the keys to wake up my machine,
>> which is a X260, also skylake, also 4.8.12 + xen 4.6.4.
>>
>> -> this doesnt happen always, but around 20% of the time or so. Pretty
>> often.

It often seems to suspend correctly (backlight turns off, fans turn
off, power consumption minimal (does not get hot over time), and power
button & top-cover LEDs start pulsing) but does not wake on any input
(keyboard, touchpad, or pushing the power button). In order to recover
from this state I must press and hold the power button for several
(~3-5?) seconds. Interestingly, pressing the power button again
appears to start the normal power-on sequence (keyboard flashes, power
button led turns solid-on, etc.) but does not actually boot (IIRC
hangs at black screen after lenovo logo splash or something), and I
need to hold it an additional time (IIRC turning off after ~1 second)
and turn it on again. It always boots fine this 2nd time. This happens
about once a day.

Very occasionally (~ once a week) it will fail to suspend. I close the
laptop, and the backlight turns off and stops responding to input, but
the power status LED on the outside of the lid stays solid red (does
not begin pulsating), the fans stay on, and will get hot if put in a
backpack.

>> I think we should file an issue in the "real" tracker… (or is there one
>> already? I think I tried searching for one, but didnt fine any…)

Not sure where you mean. kernel.org? xenproject.org? qubes-issues?

>> I'd also be glad to try a 4.9 or 4.10 based kernel…

Yeah... I've been meaning to get around to building one, but... free time :(
Same for investigating xen 4.8.

> Do either of you use anti-evil-maid? That, with recent versions of Xen,
> seems to be one of the triggers for this behavior.

I boot this machine via EFI. I am not aware of ever having gotten
legacy booting to work on this hardware (which is required for AEM
[1]).

[1]: https://github.com/QubesOS/qubes-antievilmaid/commit/4264f113b85085d20e4d8cacc5d2a0ae196af1ed

[Holger Levsen]

On Mon, Feb 27, 2017 at 03:42:51PM -0500, Chris Laprise wrote:
> Do either of you use anti-evil-maid?

not yet.


--
cheers,
Holger

[Jean-Philippe Ouellet]

New HCL attached.

No remaining complaints about this laptop (well... aside from being
too new for coreboot). It is entirely usable as a Qubes machine.

I get about 6 hours battery life with a workload that involves
starting many VMs frequently (lots of DispVM starting seems to be the
largest drain).

Hopefully one day High-DPI support in linux in general will improve
and I can take advantage of my whole screen. For now I'm running in
globally-reduced resolution (in dom0) due to inconsistent scaling
across apps and VMs. This means less pixels to software-render in VMs
anyway, which is nice for performance, power consumption, and screen
tearing.

I still have iwlmvm & iwlwifi in my sys-net's
/rw/config/suspend-module-blacklist. Haven't tested if it's still
necessary since the drivers are reloaded faster than I can type my
screen-unlock password anyway, so in practice I don't care :)

Suspend/resume was fixed at some point by a BIOS update. Not one of
the ones where they mentioned sleep/suspend/resume in the release
notes though...

The latest BIOS hashes I observe are:
$ sha256sum n1*17*
4b5488be128d9c022cd4924476d48e38dd55c38809db0f3a6c06f1a2d2ad0217 n1fuj17w.exe
918c836905db7709433b4dc03eddcbb04ccb8773f31f5b22b5b92388b56a3002 n1fuj17w.txt
5e5f9cfec0dcb299a033be0b4006af8697045876c4ef18a34716b894c48b917b n1fur17w.iso
1dcdf1ffd2cd30be225db49e8210de2dabba32c5aaf3179a89e3d8f0cca61f3a n1fur17w.txt

Obtained from:
https://download.lenovo.com/pccbbs/mobiles/n1fu{r{01..17}w.{iso,txt},j{01..17}w.{exe,txt}}

Downloaded from multiple network positions over multiple days with
matching hashes.

[Jean-Philippe Ouellet]

On Tue, Apr 4, 2017 at 3:40 AM Jean-Philippe Ouellet <j...@vt.edu> wrote:
> The latest BIOS hashes I observe are:
> $ sha256sum n1*17*
> 4b5488be128d9c022cd4924476d48e38dd55c38809db0f3a6c06f1a2d2ad0217 n1fuj17w.exe
> 918c836905db7709433b4dc03eddcbb04ccb8773f31f5b22b5b92388b56a3002 n1fuj17w.txt
> 5e5f9cfec0dcb299a033be0b4006af8697045876c4ef18a34716b894c48b917b n1fur17w.iso
> 1dcdf1ffd2cd30be225db49e8210de2dabba32c5aaf3179a89e3d8f0cca61f3a n1fur17w.txt
>
> Obtained from:
> https://download.lenovo.com/pccbbs/mobiles/n1fu{r{01..17}w.{iso,txt},j{01..17}w.{exe,txt}}
>
> Downloaded from multiple network positions over multiple days with
> matching hashes.

Bumping this...

If anyone sees differently, I would love to know.

I now observe the following hashes:

378a6305edb9397978e60b7908a85dd8c2546f2808cb845552d5e4a8ba9baab3 geteltorito.pl

c1097a887cff07ef1f67edb8b7dabff0e3005c2251116c0754e5eb0830f32430 n1fuj01w.exe
cf6b5ab8fa0d8a99ffb74b74d6c94c3fbe48708ffb29ef41e07a23e148b297ef n1fuj01w.txt
cd9c4a2df77f6108474cc1e17e6f1170a0e03e7bc256d800f5258c3346c93e49 n1fuj02w.exe
eec6b405f6ceae42612d8b62ae25096cd30f43dc4689ebe840280d435947764c n1fuj02w.txt
58c0b4bc74663a548713b9922b4db70151279407f9bdf3ef418002a09ef4a9d3 n1fuj03w.exe
622f9cb43bc4d4a19af52975be68dcc37d20ac691602f4ac1714986c3a537b02 n1fuj03w.txt
7c505961e2745ec31a4a993a1031e975a0827f773575a2405a883a08d8a4452e n1fuj04w.exe
9eff5cdd020656a5665532a1f7cb37882793f6a5740b90d815fddf17dd394f9a n1fuj04w.txt
510abd4ba7e3c185c13d19eab76b96d1340deee25a47f81a5c47fa1bf6f7f62c n1fuj05w.exe
4bd87344f2f3bf8ac8f5ad52ed2362cd144631ead66cafa82027053a0d25f713 n1fuj05w.txt
8934bc9b00b3aab1d6044e0fc1f843cd7812ec90c8d4a8c594247d6f9c8cc5c2 n1fuj07w.exe
3762fe8ac73a687d9cfd41503b2b4b6f225761e5275892da9744ac5d84d6b96c n1fuj07w.txt
9aca522cad73123054a351699108d3c2c492eaf0c8466a85aef3cd598910ed8a n1fuj08w.exe
ef1c8620d7b8e89be88f8230a4707340213c8e44db38008a10bcee1e5ecffe2e n1fuj08w.txt
5fdfc28923ea4fd0908bcd877cbe08971f65db954aa30d3fc0066c9ab98da508 n1fuj09w.exe
a969a9c5c2cb1887fc8552ba70dc5873bcaecda9601fdba47496b0e37591b02d n1fuj09w.txt
294e47c8f3435cf2b0d43aef733347ab6fd8494dcda04df2eac2d3f1d4c9cbea n1fuj10w.exe
7ed28a40f7944462e67a18ae87e7f2d5edb9ee95e94899f9e7f05fa5b63a4081 n1fuj10w.txt
0b255f1e411506564e17f6c958033e3ab65536580bd818a5992caecc7301dbf5 n1fuj11w.exe
a67d94483ce16318dc8e17611cf38565304dc96a790577669ea90070a9406fd9 n1fuj11w.txt
0e13111e41f0ae79c0941865ee9647a19b698368ae71d1fca81f35a837463b85 n1fuj12w.exe
c10ed88917a7f8779059a07e9f517b925a2ba714040518f019293728bbe4b0eb n1fuj12w.txt
903196dbf8203c322698b47236ba0bae7ba90289f393388a2a309c50374380c6 n1fuj13w.exe
e13fdf934c2e876741ee1334319935ae068dd25074323fd62d13f036ad942e11 n1fuj13w.txt
06074abd89cc023f0e815ea6375bf96649cfebea358be29ddd0f91bf3afe47f2 n1fuj14w.exe
c940dc7bf33fca19d23d755d3148ef52669dbb32b9f7762de70e3b95993faff9 n1fuj14w.txt
ce7c38435511a332d6c3ea8fd3291f7fff5815d1b73be0b01eea5c38229609c5 n1fuj15w.exe
83b2a8a17be3e0e23465d419c130e389ea3134d3d4fbfd3b6d38962651ecccc3 n1fuj15w.txt
e069a8cd0e4f01da260085eac3742123f0f05f33dc476bd4820cead9ce54b9d7 n1fuj16w.exe
49bbe527d17937dcb5cd5e0a5abd565a712b4b0d44eb6c78aaffcac2f558c4e7 n1fuj16w.txt
4b5488be128d9c022cd4924476d48e38dd55c38809db0f3a6c06f1a2d2ad0217 n1fuj17w.exe
918c836905db7709433b4dc03eddcbb04ccb8773f31f5b22b5b92388b56a3002 n1fuj17w.txt
cde452963d3a12a9375f1ccd5b8f9db113e285bd76cc099d89c037b46204a7dd n1fuj18w.exe
4d8ac7a3200b73f19c724bcc9f06e5caf626121ee77dd157505eae0a14f8249d n1fuj18w.txt
261375c8609331ee2f3adc2c5aaf968ddc501f2b5a6161156d2393e08a0366c7 n1fuj19w.exe
443a60ee8ff7cedcbd66d2fd1e2d69392e1eaaae3ae32507f680526c77fa04b5 n1fuj19w.txt
5b3079c922a4210c0a19bf3b7ea7a44310810109c8865d1ddfb202d26e1303d8 n1fuj20w.exe
65ad67bbdcb31ff87588b3a15705150c044ac1ff79dde726e39349c345e49eaa n1fuj20w.txt
f77453a0d42fa4a4bcbec51085c7f7b9a72224f220fad8649cbc854e4e4ea10e n1fuj21w.exe
7434c1debd14a1aee071a15a2ba082f47209766d77a0828b3e9b4801cc24afa1 n1fuj21w.txt
0e7e771e31002f27fd313c9d142fde491c8639092cf8a3d7c150010af3575722 n1fuj22w.exe
8d3f40bf296984d07c9cee53ea15b4f12c1129898bc5f83415e3ddf003c42a6c n1fuj22w.txt
25494ccbf473437769eb71e9dc1639440460421c54318184cc2ad3ddf7a9b00a n1fuj24w.exe
ef4ab767f78c42c549751b905d34b687328d71c5d86483d4cec24f6c61f97be8 n1fuj24w.txt
2ef53f0a56109da13b27996ce0fd56d01cc4ddfe8c45f3d304fd5ddd4172f9b2 n1fuj25w.exe
14c4e07bfd4fa0a50936c82135a3a9f06ada6b2213e86f54e9ec271c660f0b1a n1fuj25w.txt
c7347f4ac6ad5c9fc460166907136b15d07ad50cae33cccdf2c36dac9efc78bc n1fuj26w.exe
bce85d5fe3009305085b9fa0b91650a28f11871abcd00dca1e8a1a309e57b927 n1fuj26w.txt
104608e2de978e38d1813dc6427961b0f112fbb89f899423c46647eff4bfb294 n1fuj28w.exe
ae73d24a1fa7521f426dd778e3eb3f8603be158cf53ee70e30be724d32aeea54 n1fuj28w.txt
df3fb0d57cec4a979abcd7dd1a6ecb98f89089545127a9a4affefbe76756ccb6 n1fuj29w.exe
f4711a5f16157049b266f475a62cf52d96398090a7ccec3a24471197f17bdbcb n1fuj29w.txt
7e45c16c08a336c4337abbb188cc362c5198ec4a003c1b8b5185f54207baf3e9 n1fuj30w.exe
80a6bc600659b139b903023ac104f509fc4ba18d63b2530e817e70f38ea80b52 n1fuj30w.txt
f152b848779db9f333fe0d82c8aa98b6d5c4a686c32e225fb349ceb813c0f2b3 n1fuj31w.exe
e7ec4299f152dafff79e6edac51888717cfbb86d49a5b46612da1c3340eb38e0 n1fuj31w.txt
7d149f8a7e884cbe36fec98826eac62df2403c2eb81b5e9153c77afbfdc387af n1fuj32w.exe
f3ffa97d75a8235180b63f0455f163b40f6d043dd61217e5c068c8c0fe2a274f n1fuj32w.txt
d52ec53693b233bf10c5d347bfb561a25f7b764f2aa7e98623d75cdd3308c3da n1fuj33w.exe
4a68bc6851c1614e565db9cc42229ed324353cd796a9ccd6d6d2a67f0602e971 n1fuj33w.txt
f01d48943e46b87ba88a3949661573280e77c20253a36ebab26935b9e946c595 n1fur01w.img
344a1eff642cc484d63acb4ebad7af7aa83dd490cee0930cfe123a6ec6c6c39a n1fur01w.iso
8f60efcec86a293f29ffdd0a355075ebf7d7c07a7100bdab97d30842cef32647 n1fur01w.txt
be09a6439d32598a7853014b97a2bf70b449850f328b41ae46b8f682465f23e2 n1fur02w.img
344809c081964a028d05c61d124d239a07d58e4d683b50654c60a194ed22981a n1fur02w.iso
9fc05e52255852e48af89e907f5bbcbb845bc53156fd44291ac0d13925d7c465 n1fur02w.txt
f85ba9d5e7d658805567703df84c3b8140d61ec1776e098cbc3a3df9a98f2aae n1fur03w.img
33481350a8a6a35dde83776f64c247f1230ee86c6cab45a192765cda5d774721 n1fur03w.iso
1ba3d0366c10458e72ed726ef0d2535a3d126524b88c2f8fac5d9a9e02737d84 n1fur03w.txt
f57e7e2e976a852df3ba43012a1f6db985c8a9702cafd98185a09e63e83a7391 n1fur04w.img
cc81f19286cbd880a576c940f7dbed3bd3ae3d6b7ea5a787f6027b403ce0c500 n1fur04w.iso
b73f125f45e112ee006f10435f9e595e92b5003801539da778464fda9f89b2ab n1fur04w.txt
8c745b617c126af764d868bd81f3b092096650bb20e0bf774600f920b1a7153b n1fur05w.img
67a886d0a53800d1b33e47e2e923e9d508042cea42bf472d255c233149214cb1 n1fur05w.iso
622b3bbe6cd4684f3c0e2161524a4d83ce37375af15770f259c0eddadf39c2ad n1fur05w.txt
f1e2893d0cce381bf56385c494226790753e300cd8448b5b78785348861b6e11 n1fur07w.img
eb2a5db27efee01e8278fa6e7d8f0f472a8548e818d08af18c4f0931fa22a355 n1fur07w.iso
ab4d45ba72adf6dd5b9d7699d456adbeb135f1e8c867114ded72d322b7eedbca n1fur07w.txt
a145acdbf71ab60a266956e4caa7f118c52101b88ccc8c1dc2d98a29e735272c n1fur08w.img
9dda91984092cbba3638c1640a499377ba0b4c87ffa5be786dd75602065c9d69 n1fur08w.iso
7a7c7abac150cb1f85fcc3176c46163c06ffb8624c346b061809aad264757799 n1fur08w.txt
28657eba30bd6e046ebc214bb49f3307214bdc76cddad1acaa6369d7d463a4b9 n1fur09w.img
402ac2b7ccf72945940e76e89c33be0bd2f2ca1ebe4bf3658db1ded7d6aed1a1 n1fur09w.iso
73ab96e48e1d18a44e89fd14b5b7588e4feccabf269e01e229b1ff91039af299 n1fur09w.txt
f18ff8ba718b8de2efdef679748c18e7fcef32f4ba3d66914b70467e4a9ba282 n1fur10w.img
850e43b4d244c5611e7ea46f03afa92077a13bc2df27f598162582195c836f13 n1fur10w.iso
d54aa261d4e5c2905d82b7e1e6a70274e6cde41596b340d45247bd7ee0589656 n1fur10w.txt
3b4fe1d20f11e1198d7688bfff2d494d18def1f22da4f0ed9eb276ea1d41c5a0 n1fur11w.img
cd5216b5f52e3af730b9b3e44e6d88ee4f6af3f9dcfd588ff60b6a4785baafc6 n1fur11w.iso
58f09cb9b53f9da81d43cdf9894cdd72e358bbd17db281f87523a7881425cdea n1fur11w.txt
e15fa987b0285254519cfb755667d7174374c75b1323343f69f9fc0670bc875f n1fur12w.img
eb08c3723293d82dd5f0f953de16d7f995b70b4abc6c7ab9144b620941a658f8 n1fur12w.iso
bebf6bce6ff99ed66737f6fbad958f949a06b3df7173941ff6062f76c7c2f8e3 n1fur12w.txt
8b978504bd8e3252f0c2d826b3c09d3d773ba12b0db9593001777c3fa971f262 n1fur13w.img
2fcb04d23d24e8273010d2a215cfe584b55c0a8ae6774a94a43efe4753171719 n1fur13w.iso
a0fbf87fca61ea3b872b159acdef9dccf49893895cb4b6025bb2f168c654992e n1fur13w.txt
f59bf41ae3fbfe51963e4f344fbbeb14c1d91e67b152bbc5d2a0e18b284bb527 n1fur14w.img
3c03ab72805edc27efcb54b07c587c6615d59ecfe7ec7676f7ffc90ef334ac9d n1fur14w.iso
2c0006b7657d118cb92158588d4fbe4c79ddd555d0e61b3653578b47e1ce62c2 n1fur14w.txt
64c14e3e97a1d51aef7fe085fcc551368d182baf312591e08a349f3b8d5a771c n1fur15w.img
b6ea1692b07ff7b88ed709c09f642d6dd6fb19f9091307aea3f771068b13ee01 n1fur15w.iso
52d2db2a856a9f0e5a9305fa032bf8d2b0e979a6accef02b27dd708926c4a02e n1fur15w.txt
a7440dd8025fc28e74f85a79bbe1573669390e27d2ac742867d15c49b811abbf n1fur16w.img
7e2cfb037ce6508cfe7960be1c9a588e7e69fcd4bb64e23fe18d84dfba760480 n1fur16w.iso
19b1fa21a0535b7674719f9b3413d17acf66967563012c0eb18a3163b83257b3 n1fur16w.txt
7c51802b3d9c9c9bdd758215f79556f4282fed57b4d9f1e07cded16a6d6a0c9d n1fur17w.img
5e5f9cfec0dcb299a033be0b4006af8697045876c4ef18a34716b894c48b917b n1fur17w.iso
1dcdf1ffd2cd30be225db49e8210de2dabba32c5aaf3179a89e3d8f0cca61f3a n1fur17w.txt
89197790f6714b15b031c5c1d2801b1952acec77616f25bd48511dfbc61232b8 n1fur18w.img
f7d6e53775eebd980f2d2f44cff92c5594bc12b886391505d6dd403664251f55 n1fur18w.iso
d087c78d615202731d8e9fcceaf23cd2ee76db4637f91b94bfa7b0645a0f8043 n1fur18w.txt
3e09639a988bf47456ba6b3c51ed911caec7d0c5ddedf76df6befaa6779862ba n1fur19w.img
8ee5499a0f3bdd5a1a0a7f9695515f1118bb14691cb04459354f35e4e31e40db n1fur19w.iso
ab56e74676cec873015ec4c5c9a779544bea17701d61e928e34971f5be1e21a8 n1fur19w.txt
446e3c2bc798958d9c2906d22a0e7ba6b40e090fa2cabfe7e32a6cd47ee73a40 n1fur20w.img
d61784d91dd38a5c2ac075497bdb8f584edd0eade243ee6d107e2c483d090288 n1fur20w.iso
07d8ca0f6c10119095ef14598d696da8842e0572da59259b7fbccf7b17057ce6 n1fur20w.txt
79b1aeb1cce745539566ba23e843e2f2cfd6eadfb50feb1db3685a0861faa7a3 n1fur21w.img
6748d605e5017aef1ad8936a79e31dbc739cdbb28f62e67fd96a9d7f1164c305 n1fur21w.iso
4008cb8f10152ff4580898e1287792d8fc676eda8b65a2900ca4859e46aeeef3 n1fur21w.txt
2359159ad23fc748e4ec93f617a706f45e1479f4e18b1bb5208f570bccce0715 n1fur22w.img
862e2b647bbd0724a4a8bfac57d9359779c58375fb13fc4b77f78684d3957efa n1fur22w.iso
fd84d87351f470e680fa2bdb2fa05c7c094d5e57f6e5f71ab5002734b4e6faf7 n1fur22w.txt
2b1c38a0193fe46c2d0a0cdfdf5cce04e60c59b7a8987b15e06d74b0cc42db0c n1fur24w.img
a8748fff8f4a458559de23a5b933c0c3b2f8748de07c29e42989f57df3fa5b84 n1fur24w.iso
0494efcef183c7c28b101aec98f2a492e44e0c856cf0209e01f92eadcdc5373d n1fur24w.txt
dd9465ae7b891ef052120c89820b78190923b988e5333da7efcc875823c6c951 n1fur25w.img
cff3a112ce6e53f5928966be9c01b9d0ac03c8f0c5924ccb40d25ac3a6b1b56c n1fur25w.iso
fa70505889e0de5f8c3df1ee9ebe4e10542942e27431e3fc0682f0cd06a3e8fd n1fur25w.txt
12b5d5d34499c9c7574fd904dfe981d0201dd29ae76eac480efc750fd129698a n1fur26w.img
cce2663dfeb7427738a40129328932dc65094cc3fcafbc5dac027dd9be43c4e4 n1fur26w.iso
0f3561a2a597c7596b2b04a0565cf02826676751f86056b10943447e53eeab21 n1fur26w.txt
412b43224117f7ad90186403f6aad51cc3cc692444601f885c59481a2f127804 n1fur28w.img
484c987ea8384d3a2d839b47498665a74a11d939dc8211fe7fcc9557f463754c n1fur28w.iso
903464e559a43afdc3a1b6e0891ac4effd8ab15aa693016eb987c5a26d7f64c1 n1fur28w.txt
02eeaca78a34d4eaf188c4c51d6f1c510afba29b769ec227ca4d4fb48552278b n1fur29w.img
f35c405859c7876f937465234bb734333c60af626dcf446226878a7b52287e54 n1fur29w.iso
13309935c8fe81318d2fad5079d6a8534c8316f9336226455e0b3f2cbd3badfe n1fur29w.txt
55742073f8bbcbf3a5619aa6a7de286e2275dc09686f35e56cfdd8d95f71288b n1fur30w.img
152dd1e3569deb572bc726693864b676b4f3b38388659c33fd9df7ac93b03ded n1fur30w.iso
c576ed198a0c5cd3c194b097c614f9aa8bb740cfdda7777481c991c33ed20eaf n1fur30w.txt
fc05d3d2e9651e741d426d8c216e3a737bdec3ec50043a2943dd3ac73a8decdd n1fur31w.img
363a9d489d54fade234d7068215bc5761c61c04167b049f8b24bfddeb955dc3a n1fur31w.iso
7b5f7931198573ed2f17dc25a7bdd6b0e11046797af6e3899f15fe03abfe9f4a n1fur31w.txt
b8dd3d5e7f1e55c0896cdb2a54dd01b64860975df708242544687f5f3983ab3e n1fur32w.img
7104b895b9f4501ac00abc97b06cb7b30ce73e67bb8e20ed621f31343f7fbbb5 n1fur32w.iso
a17673107f1f31299c1aebf75e4d41847d6f0a301e16f2e3e8f11ff5a590bfae n1fur32w.txt
f4e8819fde331ccdb8fa1441aa02034dd30869f97cf3425abba509d01d702df9 n1fur33w.img
92f487abd785756c53ae1abc710fbb9b54d3815c43d9286b84e5aa0962f174a9 n1fur33w.iso
63fbb59efde14e050c6ffe9336efc887934d15cccc1aeffa20e25c90f4a6d56c n1fur33w.txt

Interestingly, the following has changed since I first started recording these:

old hashes:
5c21d2b69ae2a48d5e25349adb6177463a0942e41e0459753125609ca22dae32 n1fur05w.txt
9529cdab4d2e8a84afae236e1b7c38459ce4d5bc6ca1a01ec551a126d1abe395 n1fuj05w.txt

new hashes:
622b3bbe6cd4684f3c0e2161524a4d83ce37375af15770f259c0eddadf39c2ad n1fur05w.txt
4bd87344f2f3bf8ac8f5ad52ed2362cd144631ead66cafa82027053a0d25f713 n1fuj05w.txt

with effectively the same diffs between the two files:
--- old/n1fur05w.txt 2016-03-04 04:02:27.000000000 -0500
+++ new/n1fur05w.txt 2016-03-04 04:02:27.000000000 -0500
@@ -1,10 +1,9 @@
-
Revision : 02
+
Revision : 01
--------------------------------------------------------------------------------
Software name BIOS Update CD
(ISO image file for bootable CD)

-Support models ThinkPad X1 Yoga (Machine types: 20FQ, 20FR)
- ThinkPad X1 Carbon (Machine types: 20FB, 20FC)
+Support model ThinkPad X1 Yoga (Machine types: 20FQ, 20FR)

Operating Systems Microsoft Windows 10 64-bit
Microsoft Windows 8.1 64-bit
@@ -47,7 +46,7 @@
Nothing.

[New functions or enhancements]
-- Added support for ThinkPad X1 Carbon (Machine types: 20FB, 20FC).
+ Nothing.

[Problem fixes]
- Fixed an issue where an unexpected warning message of Lenovo Settings might
@@ -368,7 +367,6 @@

Package (ID) UEFI BIOS (BIOS ID) ECP (ECP ID) Rev. Issue Date
-------------------- ------------------- --------------- ---- ----------
- 1.08-1.06 (N1FUJ05W) 1.08 (N1FET34W) 1.06 (N1FHT23W) 02 2016/03/04
1.08-1.06 (N1FUR05W) 1.08 (N1FET34W) 1.06 (N1FHT23W) 01 2016/02/03
1.08 (N1FUR04W) 1.08 (N1FET34W) 1.05 (N1FHT22W) 01 2016/01/29
1.06 (N1FUR03W) 1.06 (N1FET32W) 1.03 (N1FHT20W) 01 2015/12/30
@@ -394,10 +392,6 @@

<1.08-1.06>
UEFI: 1.08 / ECP: 1.06
-- (New) Added support for ThinkPad X1 Carbon (Machine types: 20FB, 20FC).
-
-<1.08-1.06>
- UEFI: 1.08 / ECP: 1.06
- (Fix) Fixed an issue where an unexpected warning message of Lenovo Settings
might appear when the ThinkPad OneLink+ to RJ45 Adapter was attached.

@@ -438,6 +432,14 @@
* Microsoft, Internet Explorer and Windows are registered trademarks of
Microsoft Corporation.
* WinMagic is a registered trademark of WinMagic Inc.
+* SecureDoc is a trademark of WinMagic Inc.
+
+Other company, product, and service names may be registered trademarks,
+trademarks or service marks of others.
+ion.
+* Microsoft, Internet Explorer and Windows are registered trademarks of
+ Microsoft Corporation.
+* WinMagic is a registered trademark of WinMagic Inc.
* SecureDoc is a trademark of WinMagic Inc.

Other company, product, and service names may be registered trademarks,

So, it appears that the revision of the published release notes were
decremented. The associated firmware files appear unchanged though.

The current certificate chain I see for download.lenovo.com is:

$ cat cert-chain
-----BEGIN CERTIFICATE-----
MIII7TCCB9WgAwIBAgIQBBAZRnn/NRsWBXEhpEv6kzANBgkqhkiG9w0BAQsFADBe
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMR0wGwYDVQQDExRHZW9UcnVzdCBSU0EgQ0EgMjAxODAe
Fw0xODA1MjQwMDAwMDBaFw0xOTExMjIxMjAwMDBaMHkxCzAJBgNVBAYTAk1ZMREw
DwYDVQQIEwhTZWxhbmdvcjEWMBQGA1UEBxMNUGV0YWxpbmcgSmF5YTEiMCAGA1UE
ChMZTGVub3ZvIFRlY2hub2xvZ3kgU2RuIEJoZDEbMBkGA1UEAxMSc3VwcG9ydC5s
ZW5vdm8uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqkR09OMb
FtTFiyIZni7Mn4SpFjZKQb7N1UqxryfbIMnAwvgbYeA58oplwkZJm3/3XIFTQIAY
xVId2L83AwjTtpUwTGNXXXcofVqdK5k4nJtl8S+HRtxA/xj1zxJkDHw7pD0iwbig
7FlNsaVd2HUz4giDouk/tsXX/My5CjQQcwKOIG2thxj2VCepyM/pFQFUGjXEEvXz
UeNGUB4SdOhdugMTyJxSdD2TObJUpWD9quk4KFpymNlVhAEMPGugQfgqZoWyo3Rx
PIEsVAET6E35c7MspygrrV7jyMhO1/6V5Iwd4Ba/D5W248ZqrUk1ASGRmZXB0HMf
ZQUBYiUJJH0PpwIDAQABo4IFijCCBYYwHwYDVR0jBBgwFoAUkFj/sJx1qFFUd7Ht
8qNDFjiebMUwHQYDVR0OBBYEFK97HQ/SnuKpRmXF7xsDHhFz8Vs5MIICggYDVR0R
BIICeTCCAnWCEnN1cHBvcnQubGVub3ZvLmNvbYIPYjJyLm1vdG9yb2xhLmlughVj
b21tZXJjaWFsLmxlbm92by5jb22CFHN1cHBvcnQubW90b3JvbGEuY29tggxwLnN0
YXRpYy5wdWKCFXN1cHBvcnRhcGkubGVub3ZvLmNvbYIXc21hcnRzdXBwb3J0Lmxl
bm92by5jb22CFGxhYXBpLmNzdy5sZW5vdm8uY29tghdsYWFwaS5jc3cubGVub3Zv
LmNvbS5jboIQbWIyci5tb3Rvcm9sYS5pboIXZmlsZWRvd25sb2FkLmxlbm92by5j
b22CD3Bvcy5tb3Rvcm9sYS5pboIWY3VzdG9tZXIzNjAubGVub3ZvLmNvbYIMbS5z
dGF0aWMucHVighhtb2JpbGVzdXBwb3J0Lmxlbm92by5jb22CGHRlc3QuZG93bmxv
YWQubGVub3ZvLmNvbYIebGVub3ZvbW9iaWxlc3VwcG9ydC5sZW5vdm8uY29tghJj
bXMuY3N3Lmxlbm92by5jb22CHGRhdGFjZW50ZXJzdXBwb3J0Lmxlbm92by5jb22C
FHBjc3VwcG9ydC5sZW5vdm8uY29tghVjbXMuY3N3Lmxlbm92by5jb20uY26CFW1v
dG9iMnIubGVub3ZvdWF0LmNvbYISYWNjb3VudC5sZW5vdm8uY29tghZ1cy5kb3du
bG9hZC5sZW5vdm8uY29tghZjbi5kb3dubG9hZC5sZW5vdm8uY29tghljdXN0b21l
cjM2MC5sZW5vdm8uY29tLmNughNkb3dubG9hZC5sZW5vdm8uY29tghRwcmUtc2Fs
ZXMubGVub3ZvLmNvbTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUH
AwEGCCsGAQUFBwMCMD4GA1UdHwQ3MDUwM6AxoC+GLWh0dHA6Ly9jZHAuZ2VvdHJ1
c3QuY29tL0dlb1RydXN0UlNBQ0EyMDE4LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG
/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BT
MAgGBmeBDAECAjB1BggrBgEFBQcBAQRpMGcwJgYIKwYBBQUHMAGGGmh0dHA6Ly9z
dGF0dXMuZ2VvdHJ1c3QuY29tMD0GCCsGAQUFBzAChjFodHRwOi8vY2FjZXJ0cy5n
ZW90cnVzdC5jb20vR2VvVHJ1c3RSU0FDQTIwMTguY3J0MAkGA1UdEwQCMAAwggF9
BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB2AKS5CZC0GFgUh7sTosxncAo8NZgE+Rvf
uON3zQ7IDdwQAAABY497wCAAAAQDAEcwRQIhAJcMZhqjHEmx47xVtP9JflUAX0AR
9Fi/YbXivHBQ0PlWAiAxNt/K8hGz6TpQnkDZnMGkXcn+H/+fv513efYtvRIaLwB1
AId1v+dZfPiMQ5lfvfNu/1aNR1Y2/0q1YMG06v9eoIMPAAABY497wOoAAAQDAEYw
RAIgGw1dmbYe9ZvEWJIAP8ALlfCNSVbYp0OpmSoSyM3uyOoCIFGdBrwDnrpA5ca+
UtBtsdZcnU7HhrwRVmPDFk9iJ+b9AHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUuga
kJZkNo4e0YUAAAFjj3vA8gAABAMARzBFAiAjeOOppHupWy4JfsII2DxKrWur/2AO
J+nlpzssJWUsdgIhAPcRN9cx+Y2Is0/2GZVv8GgnfnDl0uSQrKphROEaO56XMA0G
CSqGSIb3DQEBCwUAA4IBAQCuPwoqb8FtQ4sD4qntbq+/r9pZQY8TQxEIlKr6HGeY
w52HFoMG82/RKO/OHUjty4PI4g2HR86WGXJ96haH6p8ChmOy4mu3NNLXiYYlTa4F
MPzASBUYzdbD0rzUOrCqH6SHQ2Y8MSRJrxWEnYnh0QkwJCnLbf84f1f4/8DWpuYi
N0u4WCD1zOBA5TFB9GiDvRz5+O4OEj+0VaSTmT3+MRej4TBJSJE+vodv2R7/YvKt
NbKJj+mXHogmqFs9bPigzdCgslgM6ThMpqk6qVqQq1EmEuHZlgA0k/ov6dTWRxSX
vMvzS60PLs0whB4DFU+ndcfZcKNgFCRTbm+YgRrRXCot
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEizCCA3OgAwIBAgIQBUb+GCP34ZQdo5/OFMRhczANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0xNzExMDYxMjIzNDVaFw0yNzExMDYxMjIzNDVaMF4xCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
b20xHTAbBgNVBAMTFEdlb1RydXN0IFJTQSBDQSAyMDE4MIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEAv4rRY03hGOqHXegWPI9/tr6HFzekDPgxP59FVEAh
150Hm8oDI0q9m+2FAmM/n4W57Cjv8oYi2/hNVEHFtEJ/zzMXAQ6CkFLTxzSkwaEB
2jKgQK0fWeQz/KDDlqxobNPomXOMJhB3y7c/OTLo0lko7geG4gk7hfiqafapa59Y
rXLIW4dmrgjgdPstU0Nigz2PhUwRl9we/FAwuIMIMl5cXMThdSBK66XWdS3cLX18
4ND+fHWhTkAChJrZDVouoKzzNYoq6tZaWmyOLKv23v14RyZ5eqoi6qnmcRID0/i6
U9J5nL1krPYbY7tNjzgC+PBXXcWqJVoMXcUw/iBTGWzpwwIDAQABo4IBQDCCATww
HQYDVR0OBBYEFJBY/7CcdahRVHex7fKjQxY4nmzFMB8GA1UdIwQYMBaAFAPeUDVW
0Uy7ZvCj4hsbw5eyPdFVMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADA0BggrBgEFBQcBAQQo
MCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBCBgNVHR8E
OzA5MDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9i
YWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxo
dHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA0GCSqGSIb3DQEBCwUAA4IBAQAw
8YdVPYQI/C5earp80s3VLOO+AtpdiXft9OlWwJLwKlUtRfccKj8QW/Pp4b7h6QAl
ufejwQMb455OjpIbCZVS+awY/R8pAYsXCnM09GcSVe4ivMswyoCZP/vPEn/LPRhH
hdgUPk8MlD979RGoUWz7qGAwqJChi28uRds3thx+vRZZIbEyZ62No0tJPzsSGSz8
nQ//jP8BIwrzBAUH5WcBAbmvgWfrKcuv+PyGPqRcc4T55TlzrBnzAzZ3oClo9fTv
O9PuiHMKrC6V6mgi0s2sa/gbXlPCD9Z24XUMxJElwIVTDuKB0Q4YMMlnpN/QChJ4
B0AFsQ+DU0NCO+f78Xf7
-----END CERTIFICATE-----

Which is (for more useful search engine indexing):

$ openssl x509 -text -noout < cert-1
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
04:10:19:46:79:ff:35:1b:16:05:71:21:a4:4b:fa:93
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN =
GeoTrust RSA CA 2018
Validity
Not Before: May 24 00:00:00 2018 GMT
Not After : Nov 22 12:00:00 2019 GMT
Subject: C = MY, ST = Selangor, L = Petaling Jaya, O = Lenovo
Technology Sdn Bhd, CN = support.lenovo.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:aa:44:74:f4:e3:1b:16:d4:c5:8b:22:19:9e:2e:
cc:9f:84:a9:16:36:4a:41:be:cd:d5:4a:b1:af:27:
db:20:c9:c0:c2:f8:1b:61:e0:39:f2:8a:65:c2:46:
49:9b:7f:f7:5c:81:53:40:80:18:c5:52:1d:d8:bf:
37:03:08:d3:b6:95:30:4c:63:57:5d:77:28:7d:5a:
9d:2b:99:38:9c:9b:65:f1:2f:87:46:dc:40:ff:18:
f5:cf:12:64:0c:7c:3b:a4:3d:22:c1:b8:a0:ec:59:
4d:b1:a5:5d:d8:75:33:e2:08:83:a2:e9:3f:b6:c5:
d7:fc:cc:b9:0a:34:10:73:02:8e:20:6d:ad:87:18:
f6:54:27:a9:c8:cf:e9:15:01:54:1a:35:c4:12:f5:
f3:51:e3:46:50:1e:12:74:e8:5d:ba:03:13:c8:9c:
52:74:3d:93:39:b2:54:a5:60:fd:aa:e9:38:28:5a:
72:98:d9:55:84:01:0c:3c:6b:a0:41:f8:2a:66:85:
b2:a3:74:71:3c:81:2c:54:01:13:e8:4d:f9:73:b3:
2c:a7:28:2b:ad:5e:e3:c8:c8:4e:d7:fe:95:e4:8c:
1d:e0:16:bf:0f:95:b6:e3:c6:6a:ad:49:35:01:21:
91:99:95:c1:d0:73:1f:65:05:01:62:25:09:24:7d:
0f:a7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:

keyid:90:58:FF:B0:9C:75:A8:51:54:77:B1:ED:F2:A3:43:16:38:9E:6C:C5

X509v3 Subject Key Identifier:
AF:7B:1D:0F:D2:9E:E2:A9:46:65:C5:EF:1B:03:1E:11:73:F1:5B:39
X509v3 Subject Alternative Name:
DNS:support.lenovo.com, DNS:b2r.motorola.in,
DNS:commercial.lenovo.com, DNS:support.motorola.com, DNS:p.static.pub,
DNS:supportapi.lenovo.com, DNS:smartsupport.lenovo.com,
DNS:laapi.csw.lenovo.com, DNS:laapi.csw.lenovo.com.cn,
DNS:mb2r.motorola.in, DNS:filedownload.lenovo.com,
DNS:pos.motorola.in, DNS:customer360.lenovo.com, DNS:m.static.pub,
DNS:mobilesupport.lenovo.com, DNS:test.download.lenovo.com,
DNS:lenovomobilesupport.lenovo.com, DNS:cms.csw.lenovo.com,
DNS:datacentersupport.lenovo.com, DNS:pcsupport.lenovo.com,
DNS:cms.csw.lenovo.com.cn, DNS:motob2r.lenovouat.com,
DNS:account.lenovo.com, DNS:us.download.lenovo.com,
DNS:cn.download.lenovo.com, DNS:customer360.lenovo.com.cn,
DNS:download.lenovo.com, DNS:pre-sales.lenovo.com
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 CRL Distribution Points:

Full Name:
URI:http://cdp.geotrust.com/GeoTrustRSACA2018.crl

X509v3 Certificate Policies:
Policy: 2.16.840.1.114412.1.1
CPS: https://www.digicert.com/CPS
Policy: 2.23.140.1.2.2

Authority Information Access:
OCSP - URI:http://status.geotrust.com
CA Issuers -
URI:http://cacerts.geotrust.com/GeoTrustRSACA2018.crt

X509v3 Basic Constraints:
CA:FALSE
CT Precertificate SCTs:
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : A4:B9:09:90:B4:18:58:14:87:BB:13:A2:CC:67:70:0A:
3C:35:98:04:F9:1B:DF:B8:E3:77:CD:0E:C8:0D:DC:10
Timestamp : May 24 00:10:42.080 2018 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:45:02:21:00:97:0C:66:1A:A3:1C:49:B1:E3:BC:55:
B4:FF:49:7E:55:00:5F:40:11:F4:58:BF:61:B5:E2:BC:
70:50:D0:F9:56:02:20:31:36:DF:CA:F2:11:B3:E9:3A:
50:9E:40:D9:9C:C1:A4:5D:C9:FE:1F:FF:9F:BF:9D:77:
79:F6:2D:BD:12:1A:2F
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : 87:75:BF:E7:59:7C:F8:8C:43:99:5F:BD:F3:6E:FF:56:
8D:47:56:36:FF:4A:B5:60:C1:B4:EA:FF:5E:A0:83:0F
Timestamp : May 24 00:10:42.282 2018 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:44:02:20:1B:0D:5D:99:B6:1E:F5:9B:C4:58:92:00:
3F:C0:0B:95:F0:8D:49:56:D8:A7:43:A9:99:2A:12:C8:
CD:EE:C8:EA:02:20:51:9D:06:BC:03:9E:BA:40:E5:C6:
BE:52:D0:6D:B1:D6:5C:9D:4E:C7:86:BC:11:56:63:C3:
16:4F:62:27:E6:FD
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : BB:D9:DF:BC:1F:8A:71:B5:93:94:23:97:AA:92:7B:47:
38:57:95:0A:AB:52:E8:1A:90:96:64:36:8E:1E:D1:85
Timestamp : May 24 00:10:42.290 2018 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:45:02:20:23:78:E3:A9:A4:7B:A9:5B:2E:09:7E:C2:
08:D8:3C:4A:AD:6B:AB:FF:60:0E:27:E9:E5:A7:3B:2C:
25:65:2C:76:02:21:00:F7:11:37:D7:31:F9:8D:88:B3:
4F:F6:19:95:6F:F0:68:27:7E:70:E5:D2:E4:90:AC:AA:
61:44:E1:1A:3B:9E:97
Signature Algorithm: sha256WithRSAEncryption
ae:3f:0a:2a:6f:c1:6d:43:8b:03:e2:a9:ed:6e:af:bf:af:da:
59:41:8f:13:43:11:08:94:aa:fa:1c:67:98:c3:9d:87:16:83:
06:f3:6f:d1:28:ef:ce:1d:48:ed:cb:83:c8:e2:0d:87:47:ce:
96:19:72:7d:ea:16:87:ea:9f:02:86:63:b2:e2:6b:b7:34:d2:
d7:89:86:25:4d:ae:05:30:fc:c0:48:15:18:cd:d6:c3:d2:bc:
d4:3a:b0:aa:1f:a4:87:43:66:3c:31:24:49:af:15:84:9d:89:
e1:d1:09:30:24:29:cb:6d:ff:38:7f:57:f8:ff:c0:d6:a6:e6:
22:37:4b:b8:58:20:f5:cc:e0:40:e5:31:41:f4:68:83:bd:1c:
f9:f8:ee:0e:12:3f:b4:55:a4:93:99:3d:fe:31:17:a3:e1:30:
49:48:91:3e:be:87:6f:d9:1e:ff:62:f2:ad:35:b2:89:8f:e9:
97:1e:88:26:a8:5b:3d:6c:f8:a0:cd:d0:a0:b2:58:0c:e9:38:
4c:a6:a9:3a:a9:5a:90:ab:51:26:12:e1:d9:96:00:34:93:fa:
2f:e9:d4:d6:47:14:97:bc:cb:f3:4b:ad:0f:2e:cd:30:84:1e:
03:15:4f:a7:75:c7:d9:70:a3:60:14:24:53:6e:6f:98:81:1a:
d1:5c:2a:2d

$ openssl x509 -text -noout < cert-2
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
05:46:fe:18:23:f7:e1:94:1d:a3:9f:ce:14:c4:61:73
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN =
DigiCert Global Root CA
Validity
Not Before: Nov 6 12:23:45 2017 GMT
Not After : Nov 6 12:23:45 2027 GMT
Subject: C = US, O = DigiCert Inc, OU = www.digicert.com, CN =
GeoTrust RSA CA 2018
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:bf:8a:d1:63:4d:e1:18:ea:87:5d:e8:16:3c:8f:
7f:b6:be:87:17:37:a4:0c:f8:31:3f:9f:45:54:40:
21:d7:9d:07:9b:ca:03:23:4a:bd:9b:ed:85:02:63:
3f:9f:85:b9:ec:28:ef:f2:86:22:db:f8:4d:54:41:
c5:b4:42:7f:cf:33:17:01:0e:82:90:52:d3:c7:34:
a4:c1:a1:01:da:32:a0:40:ad:1f:59:e4:33:fc:a0:
c3:96:ac:68:6c:d3:e8:99:73:8c:26:10:77:cb:b7:
3f:39:32:e8:d2:59:28:ee:07:86:e2:09:3b:85:f8:
aa:69:f6:a9:6b:9f:58:ad:72:c8:5b:87:66:ae:08:
e0:74:fb:2d:53:43:62:83:3d:8f:85:4c:11:97:dc:
1e:fc:50:30:b8:83:08:32:5e:5c:5c:c4:e1:75:20:
4a:eb:a5:d6:75:2d:dc:2d:7d:7c:e0:d0:fe:7c:75:
a1:4e:40:02:84:9a:d9:0d:5a:2e:a0:ac:f3:35:8a:
2a:ea:d6:5a:5a:6c:8e:2c:ab:f6:de:fd:78:47:26:
79:7a:aa:22:ea:a9:e6:71:12:03:d3:f8:ba:53:d2:
79:9c:bd:64:ac:f6:1b:63:bb:4d:8f:38:02:f8:f0:
57:5d:c5:aa:25:5a:0c:5d:c5:30:fe:20:53:19:6c:
e9:c3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
90:58:FF:B0:9C:75:A8:51:54:77:B1:ED:F2:A3:43:16:38:9E:6C:C5
X509v3 Authority Key Identifier:

keyid:03:DE:50:35:56:D1:4C:BB:66:F0:A3:E2:1B:1B:C3:97:B2:3D:D1:55

X509v3 Key Usage: critical
Digital Signature, Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
Authority Information Access:
OCSP - URI:http://ocsp.digicert.com

X509v3 CRL Distribution Points:

Full Name:
URI:http://crl3.digicert.com/DigiCertGlobalRootCA.crl

X509v3 Certificate Policies:
Policy: X509v3 Any Policy
CPS: https://www.digicert.com/CPS

Signature Algorithm: sha256WithRSAEncryption
30:f1:87:55:3d:84:08:fc:2e:5e:6a:ba:7c:d2:cd:d5:2c:e3:
be:02:da:5d:89:77:ed:f4:e9:56:c0:92:f0:2a:55:2d:45:f7:
1c:2a:3f:10:5b:f3:e9:e1:be:e1:e9:00:25:b9:f7:a3:c1:03:
1b:e3:9e:4e:8e:92:1b:09:95:52:f9:ac:18:fd:1f:29:01:8b:
17:0a:73:34:f4:67:12:55:ee:22:bc:cb:30:ca:80:99:3f:fb:
cf:12:7f:cb:3d:18:47:85:d8:14:3e:4f:0c:94:3f:7b:f5:11:
a8:51:6c:fb:a8:60:30:a8:90:a1:8b:6f:2e:45:db:37:b6:1c:
7e:bd:16:59:21:b1:32:67:ad:8d:a3:4b:49:3f:3b:12:19:2c:
fc:9d:0f:ff:8c:ff:01:23:0a:f3:04:05:07:e5:67:01:01:b9:
af:81:67:eb:29:cb:af:f8:fc:86:3e:a4:5c:73:84:f9:e5:39:
73:ac:19:f3:03:36:77:a0:29:68:f5:f4:ef:3b:d3:ee:88:73:
0a:ac:2e:95:ea:68:22:d2:cd:ac:6b:f8:1b:5e:53:c2:0f:d6:
76:e1:75:0c:c4:91:25:c0:85:53:0e:e2:81:d1:0e:18:30:c9:
67:a4:df:d0:0a:12:78:07:40:05:b1:0f:83:53:43:42:3b:e7:
fb:f1:77:fb

These certs have changed over time.

Hope someone finds this useful. If anybody sees anything different,
I'd definitely like to know about it!

Regards,
Jean-Philippe