diff --git a/.gitignore b/.gitignore
index a5844f6..827dcfb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,5 @@ hello-dasharo/dist
 hello-dasharo/*.efi
 hello-dasharo/signing/*.pem
 hello-dasharo/signing/*.der
+hello-dasharo/signing/*.csr
+hello-dasharo/signing/*.srl
diff --git a/hello-dasharo/Makefile b/hello-dasharo/Makefile
index 9388827..206630a 100644
--- a/hello-dasharo/Makefile
+++ b/hello-dasharo/Makefile
@@ -27,13 +27,24 @@ sign: hello-dasharo.efi
 	--output hello-dasharo-signed-good.efi $<
 	sbsign --key signing/private-key-bad.pem --cert signing/cert_bad.pem \
 	--output hello-dasharo-signed-bad.efi $<
+	sbsign --key signing/private-key-expired.pem --cert signing/cert_expired.pem \
+	--output hello-dasharo-signed-expired.efi $<
+	sbsign --key signing/private-key-leaf.pem \
+		   --cert signing/cert_leaf.pem \
+		   --addcert signing/cert_intermediate.pem \
+		   --output hello-dasharo-signed-intermediate.efi $<
+
 dist: sign
 	rm -rf $@
 	mkdir $@
 	cp hello-dasharo.efi ./$@/
 	cp hello-dasharo-signed-good.efi ./$@/
 	cp hello-dasharo-signed-bad.efi ./$@/
+	cp hello-dasharo-signed-expired.efi ./$@/
+	cp hello-dasharo-signed-intermediate.efi ./$@/
 	cp ./signing/cert_good.der ./$@/
+	cp ./signing/cert_expired.der ./$@/
+	cp ./signing/cert_root_ca.der ./$@/
 	cp hello-dasharo.efi ./$@/cert_fake.der
 
 clean:
diff --git a/hello-dasharo/README.md b/hello-dasharo/README.md
index d2f8e8c..bd72e2e 100644
--- a/hello-dasharo/README.md
+++ b/hello-dasharo/README.md
@@ -1,8 +1,10 @@
 ## Hello, Dasharo Universe! - Secure Boot test program
+
 An UEFI hello-world program, but with intentionally-added delays: pre- and post;
 output to capture in tests: `UEFI Hello, Dasharo Universe!`
 
 Build prerequisites for Fedora:
+
 - mingw64-gcc
 - openssl
 - sbsigntools
@@ -14,10 +16,17 @@ Building `dist/` sub-directory, containing complete set of files for BAD_INFLUE
 `make clean && make dist`
 
 List of files created in `dist/` sub-directory:
+
 - `cert_fake.der` - fake certificate file with bad contents.
 - `cert_good.der` - proper certificate file, can be enrolled with Secure Boot menu.
-- `hello-dasharo.efi` - unsigned program binary, can be executed with Secure Boot disabled.
+- `cert_expired.der` - expired certificate file, can be enrolled with Secure Boot menu.
+- `cert_root_ca.der` - Root CA certificate file, can be enrolled with Secure Boot menu.
+- `hello-dasharo.efi` - program binary, can be executed with Secure Boot disabled.
 - `hello-dasharo-signed-bad.efi` - program binary signed with some other certificate.
 - `hello-dasharo-signed-good.efi` - program binary signed with `cert_good.der`.
+- `hello-dasharo-signed-expired.efi` - program binary signed with `cert_expired.der`.
+- `hello-dasharo-signed-intermediate.efi` - program binary signed with `cert_intermediate.der`.
+
+**Note:** The expired certificate is included for completeness. Per UEFI spec, firmware is not required to reject images signed with expired certificates (in the form that the script generates them), making them currently not viable for testing. See: https://github.com/Dasharo/dasharo-issues/issues/1863.
 
 For more information on available Makefile targets, please run `make help`.
diff --git a/hello-dasharo/signing/keygen.sh b/hello-dasharo/signing/keygen.sh
index df718ed..1bae266 100755
--- a/hello-dasharo/signing/keygen.sh
+++ b/hello-dasharo/signing/keygen.sh
@@ -2,24 +2,64 @@
 
 CERT_EXPIRATION_DAYS=730
 CERT_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE"
+CA_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Root CA"
+INTERMEDIATE_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Intermediate"
+LEAF_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Leaf"
+EXPIRED_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Expired"
 
 echo "Keys & certificates generation ..."
 
 rm -f *.pem
 rm -f *.der
+rm -f *.csr
+rm -f *.srl
 
-openssl genrsa -out private-key-good.pem 3027
-openssl genrsa -out private-key-bad.pem 3027
+openssl genrsa -out private-key-good.pem 3072
+openssl genrsa -out private-key-bad.pem 3072
+openssl genrsa -out private-key-expired.pem 3072
+openssl genrsa -out private-key-root-ca.pem 3072
 
 openssl rsa -in private-key-good.pem -pubout -out public-key-good.pem
 openssl rsa -in private-key-bad.pem -pubout -out public-key-bad.pem
 
 openssl req -new -x509 -key private-key-good.pem -out cert_good.pem \
-	-days $CERT_EXPIRATION_DAYS -nodes -subj $CERT_SUBJECT
+    -days $CERT_EXPIRATION_DAYS -nodes -subj "$CERT_SUBJECT"
 openssl req -new -x509 -key private-key-bad.pem -out cert_bad.pem \
-	-days $CERT_EXPIRATION_DAYS -nodes -subj $CERT_SUBJECT
+    -days $CERT_EXPIRATION_DAYS -nodes -subj "$CERT_SUBJECT"
 
 openssl x509 -outform der -in cert_good.pem -out cert_good.der
 
-echo "... Done."
+openssl req -new -x509 -key private-key-root-ca.pem -out cert_root_ca.pem \
+    -days $CERT_EXPIRATION_DAYS -nodes -subj "$CA_SUBJECT" \
+    -addext "basicConstraints=critical,CA:TRUE" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign"
+
+openssl x509 -outform der -in cert_root_ca.pem -out cert_root_ca.der
+
+openssl req -new -newkey rsa:3072 -nodes \
+    -keyout private-key-intermediate.pem -out req_intermediate.csr \
+    -subj "$INTERMEDIATE_SUBJECT"
+
+openssl x509 -req -in req_intermediate.csr \
+    -CA cert_root_ca.pem -CAkey private-key-root-ca.pem -CAcreateserial \
+    -out cert_intermediate.pem -days $CERT_EXPIRATION_DAYS \
+    -extfile <(echo -e "basicConstraints=critical,CA:TRUE\nkeyUsage=critical,digitalSignature,keyCertSign,cRLSign")
+
+openssl x509 -outform der -in cert_intermediate.pem -out cert_intermediate.der
 
+openssl req -new -newkey rsa:3072 -nodes \
+    -keyout private-key-leaf.pem -out req_leaf.csr \
+    -subj "$LEAF_SUBJECT"
+
+openssl x509 -req -in req_leaf.csr \
+    -CA cert_intermediate.pem -CAkey private-key-intermediate.pem -CAcreateserial \
+    -out cert_leaf.pem -days $CERT_EXPIRATION_DAYS \
+    -extfile <(echo -e "basicConstraints=critical,CA:FALSE\nkeyUsage=digitalSignature\nextendedKeyUsage=codeSigning")
+
+openssl x509 -outform der -in cert_leaf.pem -out cert_leaf.der
+
+faketime '1970-01-01 19:41:00' openssl req -new -x509 -key private-key-expired.pem -out cert_expired.pem \
+    -days $CERT_EXPIRATION_DAYS -nodes -subj "$EXPIRED_SUBJECT"
+openssl x509 -outform der -in cert_expired.pem -out cert_expired.der
+
+echo "... Done."