Index: /trunk/Config.kmk
===================================================================
--- /trunk/Config.kmk	(revision 65228)
+++ /trunk/Config.kmk	(revision 65229)
@@ -3115,7 +3115,11 @@
    VBOX_CERTIFICATE_FINGERPRINT ?= 5b de fe 58 0a 81 66 61 cd b5 7a 57 10 7b f4 18 74 86 ef cc
    VBOX_CROSS_CERTIFICATE_FILE ?= $(VBOX_PATH_SELFSIGN)/VeriSign Class 3 Public Primary Certification Authority - G5.cer
-   VBOX_CROSS_CERTIFICATE_FILE_ARGS ?= /ac "$(VBOX_CROSS_CERTIFICATE_FILE)"
    VBOX_TSA_URL ?= http://timestamp.verisign.com/scripts/timestamp.dll
-   VBOX_TSA_URL_ARGS ?= /t "$(VBOX_TSA_URL)"
+  endif
+  if !defined(VBOX_CROSS_CERTIFICATE_FILE_ARGS) && defined(VBOX_CROSS_CERTIFICATE_FILE)
+   VBOX_CROSS_CERTIFICATE_FILE_ARGS = /ac "$(VBOX_CROSS_CERTIFICATE_FILE)"
+  endif
+  if !defined(VBOX_TSA_URL_ARGS) && defined(VBOX_TSA_URL)
+   VBOX_TSA_URL_ARGS = /t "$(VBOX_TSA_URL)"
   endif
   VBOX_CERTIFICATE_STORE ?= my
@@ -3133,7 +3137,11 @@
    VBOX_CERTIFICATE_SHA2_FINGERPRINT ?= 22 05 6a 4d 46 2e 3d 2b b2 c3 2f bf b0 5b 84 c4 65 9c f7 fe
    VBOX_CROSS_CERTIFICATE_SHA2_FILE ?= $(VBOX_PATH_SELFSIGN)/VeriSign Class 3 Public Primary Certification Authority - G5.cer
-   VBOX_CROSS_CERTIFICATE_SHA2_FILE_ARGS ?= /ac "$(VBOX_CROSS_CERTIFICATE_SHA2_FILE)"
    VBOX_TSA_SHA2_URL ?= http://sha256timestamp.ws.symantec.com/sha256/timestamp
-   VBOX_TSA_SHA2_URL_ARGS ?= /tr "$(VBOX_TSA_SHA2_URL)"
+  endif
+  if !defined(VBOX_CROSS_CERTIFICATE_SHA2_FILE_ARGS) && defined(VBOX_CROSS_CERTIFICATE_SHA2_FILE)
+   VBOX_CROSS_CERTIFICATE_SHA2_FILE_ARGS = /ac "$(VBOX_CROSS_CERTIFICATE_SHA2_FILE)"
+  endif
+  if !defined(VBOX_TSA_SHA2_URL_ARGS) && defined(VBOX_TSA_SHA2_URL)
+   VBOX_TSA_SHA2_URL_ARGS = /tr "$(VBOX_TSA_SHA2_URL)"
   endif
   VBOX_CERTIFICATE_SHA2_STORE ?= my