# init(keyExchangeKeys:dbSignatures:dbxSignatures:) Creates a signature lists container from signature list objects. ``` init(keyExchangeKeys: [VZEFISignatureList], dbSignatures: [VZEFISignatureList], dbxSignatures: [VZEFISignatureList]) ``` ## Parameters `keyExchangeKeys` An array of [`VZEFISignatureList`](/documentation/Virtualization/VZEFISignatureList) objects for the Key Exchange Key (KEK) database. Must contain only X.509 certificates. If any signature list contains SHA-256 hashes, the framework raises an exception. This parameter can be empty if you don’t need to add KEK signatures. `dbSignatures` An array of [`VZEFISignatureList`](/documentation/Virtualization/VZEFISignatureList) objects for the allowed signature database (db). This parameter can be empty if you don’t need to add allowed signatures. `dbxSignatures` An array of [`VZEFISignatureList`](/documentation/Virtualization/VZEFISignatureList) objects for the forbidden signature database (dbx). This parameter can be empty if you don’t need to add forbidden signatures. ## Discussion> Warning: Make sure that the signature data is in the correct format. Applying a malformed configuration may > corrupt the variable store and render the guest unbootable. This initializer creates a container holding signature lists for all three UEFI Secure Boot databases. The following example demonstrates the creation of a `VZEFISignatureDatabaseConfiguration` with a fully custom configuration. ```objc // Load Platform Key certificate. NSData *platformKeyData = [NSData dataWithContentsOfURL:[NSURL fileURLWithPath:@"/path/to/PK.der"]]; SecCertificateRef platformKey = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)platformKeyData); if (!platformKey) { // Handle error. } // Create signature lists from files. NSError *error; VZEFISignatureList *kekList = [[VZEFISignatureList alloc] initWithContentsOfURL:[NSURL fileURLWithPath:@"/path/to/KEK.bin"] error:&error]; VZEFISignatureList *dbList = [[VZEFISignatureList alloc] initWithContentsOfURL:[NSURL fileURLWithPath:@"/path/to/db.bin"] error:&error]; VZEFISignatureList *dbxList = [[VZEFISignatureList alloc] initWithContentsOfURL:[NSURL fileURLWithPath:@"/path/to/dbx.sha256"] error:&error]; if (!kekList || !dbList || !dbxList) { // Handle error. } VZEFISignatureDatabaseConfiguration *signatures = [[VZEFISignatureDatabaseConfiguration alloc] initWithKeyExchangeKeys:@[ kekList ] dbSignatures:@[ dbList ] dbxSignatures:@[ dbxList ]]; // Enable secure boot with custom Platform Key. if (![variableStore enableSecureBootWithPlatformKey:platformKey error:&error]) { // Handle error. } // Enroll custom signatures. if (![variableStore enrollSecureBootSignatures:signatures error:&error]) { // Handle error. } CFRelease(platformKey); ``` --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)