# init(keyExchangeKeys:dbSignatures:dbxSignatures:) Creates a signature lists container from signature list objects. ``` init(keyExchangeKeys: [VZEFISignatureList], dbSignatures: [VZEFISignatureList], dbxSignatures: [VZEFISignatureList]) ``` ## Parameters `keyExchangeKeys` An array of [`VZEFISignatureList`](/documentation/Virtualization/VZEFISignatureList) objects for the Key Exchange Key (KEK) database. Must contain only X.509 certificates. If any signature list contains SHA-256 hashes, the framework raises an exception. This parameter can be empty if you don’t need to add KEK signatures. `dbSignatures` An array of [`VZEFISignatureList`](/documentation/Virtualization/VZEFISignatureList) objects for the allowed signature database (db). This parameter can be empty if you don’t need to add allowed signatures. `dbxSignatures` An array of [`VZEFISignatureList`](/documentation/Virtualization/VZEFISignatureList) objects for the forbidden signature database (dbx). This parameter can be empty if you don’t need to add forbidden signatures. ## Discussion> Warning: Make sure that the signature data is in the correct format. Applying a malformed configuration may > corrupt the variable store and render the guest unbootable. This initializer creates a container holding signature lists for all three UEFI Secure Boot databases. The following example demonstrates the creation of a `VZEFISignatureDatabaseConfiguration` with a fully custom configuration. ```swift do { // Load platform key certificate. let platformKeyData = try Data(contentsOf: URL(fileURLWithPath: "/path/to/PK.der")) guard let platformKey = SecCertificateCreateWithData(nil, platformKeyData as CFData) else { // Handle error. } // Create signature lists from files. let kekList = try VZEFISignatureList(contentsOf: URL(fileURLWithPath: "/path/to/KEK.bin")) let dbList = try VZEFISignatureList(contentsOf: URL(fileURLWithPath: "/path/to/db.bin")) let dbxList = try VZEFISignatureList(contentsOf: URL(fileURLWithPath: "/path/to/dbx.sha256")) let signatures = VZEFISignatureDatabaseConfiguration( keyExchangeKeys: [kekList], dbSignatures: [dbList], dbxSignatures: [dbxList] ) // Enable Secure Boot with custom Platform Key. try variableStore.enableSecureBoot(platformKey: platformKey) // Enroll custom signatures. try variableStore.enrollSecureBootSignatures(signatures) } catch { // Handle error. } ``` --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)