Index: trunk/src/VBox/Main/Makefile.kmk
===================================================================
--- trunk/src/VBox/Main/Makefile.kmk	(revision 104787)
+++ trunk/src/VBox/Main/Makefile.kmk	(revision 104793)
@@ -422,17 +422,21 @@
  #
  # Trust anchors and certificates -> .cpp
+ # Source for the Microsoft Certificates: https://github.com/microsoft/secureboot_objects
  #
  VBOX_SVC_CERTS_FILE = $(VBoxSVC_0_OUTDIR)/TrustAnchorsAndCerts.cpp
  VBOX_SVC_CERTS := \
  	UefiMicrosoftKek=MicCorKEKCA2011_2011-06-24.crt \
- 	UefiMicrosoftCa=MicCorUEFCA2011_2011-06-27.crt \
- 	UefiMicrosoftProPca=MicWinProPCA2011_2011-10-19.crt \
+ 	UefiMicrosoftKek2023=microsoft_corporation_kek_2k_ca_2023.crt \
+ 	UefiMicrosoft3rdCa=MicCorUEFCA2011_2011-06-27.crt \
+ 	UefiMicrosoft3rdCa2023=microsoft_uefi_ca_2023.crt\
+ 	UefiMicrosoftWinCa=MicWinProPCA2011_2011-10-19.crt \
+ 	UefiMicrosoftWinCa2023=windows_uefi_ca_2023.crt \
  	UefiOracleDefPk=OrclUefiDefPk2021_2021-09-29.crt
 
- VBOX_SVC_CERT_NAMES := $(foreach cert,$(VBOX_SVC_CERTS),$(firstword $(subst =,$(SPACE) ,$(cert))))
+ VBOX_SVC_CERT_NAMES := $(foreach cert,$(VBOX_SVC_CERTS),$(firstword $(subst =,$(SP),$(cert))))
  VBOX_SVC_PATH_CERTIFICATES := $(PATH_SUB_CURRENT)/Certificates
 
  $$(VBOX_SVC_CERTS_FILE): $(MAKEFILE_CURRENT) \
- 		$(foreach cert,$(VBOX_SVC_CERTS),$(VBOX_SVC_PATH_CERTIFICATES)/$(lastword $(subst =,$(SPACE) ,$(cert)))) \
+ 		$(foreach cert,$(VBOX_SVC_CERTS),$(VBOX_SVC_PATH_CERTIFICATES)/$(lastword $(subst =,$(SP),$(cert)))) \
  		$(VBOX_BIN2C) \
  		| $$(dir $$@)
@@ -443,6 +447,6 @@
                ''
 	$(foreach cert,$(VBOX_SVC_CERTS), $(NLTAB)$(VBOX_BIN2C) -ascii --append \
-		"$(firstword $(subst =,$(SP) ,$(cert)))" \
-		"$(VBOX_SVC_PATH_CERTIFICATES)/$(lastword $(subst =,$(SP) ,$(cert)))" \
+		"$(firstword $(subst =,$(SP),$(cert)))" \
+		"$(VBOX_SVC_PATH_CERTIFICATES)/$(lastword $(subst =,$(SP),$(cert)))" \
 		"$@")
 
Index: trunk/src/VBox/Main/include/TrustAnchorsAndCerts.h
===================================================================
--- trunk/src/VBox/Main/include/TrustAnchorsAndCerts.h	(revision 104787)
+++ trunk/src/VBox/Main/include/TrustAnchorsAndCerts.h	(revision 104793)
@@ -39,9 +39,15 @@
 extern const unsigned g_cbUefiMicrosoftKek;
 
-extern const unsigned char g_abUefiMicrosoftCa[];
-extern const unsigned g_cbUefiMicrosoftCa;
+extern const unsigned char g_abUefiMicrosoft3rdCa[];
+extern const unsigned g_cbUefiMicrosoft3rdCa;
 
-extern const unsigned char g_abUefiMicrosoftProPca[];
-extern const unsigned g_cbUefiMicrosoftProPca;
+extern const unsigned char g_abUefiMicrosoft3rdCa2023[];
+extern const unsigned g_cbUefiMicrosoft3rdCa2023;
+
+extern const unsigned char g_abUefiMicrosoftWinCa[];
+extern const unsigned g_cbUefiMicrosoftWinCa;
+
+extern const unsigned char g_abUefiMicrosoftWinCa2023[];
+extern const unsigned g_cbUefiMicrosoftWinCa2023;
 
 extern const unsigned char g_abUefiOracleDefPk[];
Index: trunk/src/VBox/Main/src-server/UefiVariableStoreImpl.cpp
===================================================================
--- trunk/src/VBox/Main/src-server/UefiVariableStoreImpl.cpp	(revision 104787)
+++ trunk/src/VBox/Main/src-server/UefiVariableStoreImpl.cpp	(revision 104793)
@@ -533,9 +533,19 @@
     if (SUCCEEDED(hrc))
     {
-        hrc = i_uefiVarStoreAddSignatureToDb(&EfiGuidSecurityDb, "db", g_abUefiMicrosoftCa, g_cbUefiMicrosoftCa,
+        hrc = i_uefiVarStoreAddSignatureToDb(&EfiGuidSecurityDb, "db", g_abUefiMicrosoft3rdCa, g_cbUefiMicrosoft3rdCa,
                                              GuidMs, SignatureType_X509);
         if (SUCCEEDED(hrc))
-            hrc = i_uefiVarStoreAddSignatureToDb(&EfiGuidSecurityDb, "db", g_abUefiMicrosoftProPca, g_cbUefiMicrosoftProPca,
+        {
+            hrc = i_uefiVarStoreAddSignatureToDb(&EfiGuidSecurityDb, "db", g_abUefiMicrosoft3rdCa2023, g_cbUefiMicrosoft3rdCa2023,
                                                  GuidMs, SignatureType_X509);
+            if (SUCCEEDED(hrc))
+            {
+                hrc = i_uefiVarStoreAddSignatureToDb(&EfiGuidSecurityDb, "db", g_abUefiMicrosoftWinCa, g_cbUefiMicrosoftWinCa,
+                                                     GuidMs, SignatureType_X509);
+                if (SUCCEEDED(hrc))
+                    hrc = i_uefiVarStoreAddSignatureToDb(&EfiGuidSecurityDb, "db", g_abUefiMicrosoftWinCa2023, g_cbUefiMicrosoftWinCa2023,
+                                                         GuidMs, SignatureType_X509);
+            }
+        }
     }
 
