diff --git a/uefi-test-runner/https/README.md b/uefi-test-runner/https/README.md
new file mode 100644
index 00000000..caf9517f
--- /dev/null
+++ b/uefi-test-runner/https/README.md
@@ -0,0 +1,7 @@
+https ca cert database in efi signature list format
+
+Copied over from centos stream 9 where this is available as
+/etc/pki/ca-trust/extracted/edk2/cacerts.bin
+
+It's the Mozilla Foundation CA certificate list, shipped in
+ca-certificates.rpm, licensed as "MIT AND GPL-2.0-or-later".
diff --git a/uefi-test-runner/https/cacerts.bin b/uefi-test-runner/https/cacerts.bin
new file mode 100644
index 00000000..6a9a48ad
Binary files /dev/null and b/uefi-test-runner/https/cacerts.bin differ
diff --git a/xtask/src/qemu.rs b/xtask/src/qemu.rs
index e197f1b1..90c2081c 100644
--- a/xtask/src/qemu.rs
+++ b/xtask/src/qemu.rs
@@ -531,6 +531,12 @@ pub fn run_qemu(arch: UefiArch, opt: &QemuOpt) -> Result<()> {
         None
     };
 
+    // Pass CA certificate database to the edk2 firmware, for TLS support.
+    cmd.args([
+        "-fw_cfg",
+        "name=etc/edk2/https/cacerts,file=uefi-test-runner/https/cacerts.bin",
+    ]);
+
     // Set up a software TPM if requested.
     let _tpm = if let Some(tpm_version) = opt.tpm {
         let tpm = Swtpm::spawn(tpm_version)?;