<!--
{
  "availability" : [
    "macOS: 27.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "Virtualization",
  "identifier" : "/documentation/Virtualization/VZEFIVariableStore/enrollSecureBootSignatures(_:)",
  "metadataVersion" : "0.1.0",
  "role" : "Instance Method",
  "symbol" : {
    "kind" : "Instance Method",
    "modules" : [
      "Virtualization"
    ],
    "preciseIdentifier" : "c:objc(cs)VZEFIVariableStore(im)enrollSecureBootSignatures:error:"
  },
  "title" : "enrollSecureBootSignatures(_:)"
}
-->

# enrollSecureBootSignatures(_:)

Enrolls the given signatures to Secure Boot databases.

```
func enrollSecureBootSignatures(_ signatures: VZEFISignatureDatabaseConfiguration) throws
```

## Parameters

`signatures`

Signatures to enroll in the KEK, db, and dbx signature databases.

## Discussion> Warning: Make sure that the given Secure Boot signatures are valid before enabling Secure Boot, otherwise it may
> render the guest unbootable.

This operation appends the given signatures to the Key Exchange Key (KEK) database, allowed signature
database (db), and forbidden signature database (dbx). The method ignores a signature that already exists in the database.
You can add these signatures before or after enrolling a Platform Key. The framework preserves the Platform Key, if present.

Call this method multiple times to incrementally add signatures without replacing existing ones.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)