If the platform creates the "TlsCaCertificate" variable as volatile, then EnrollX509toVariable() shouldn't fail to extend it just because TLS_AUTH_CONFIG_VAR_BASE_ATTR contains the EFI_VARIABLE_NON_VOLATILE attribute. Thus, if the variable exists, add the EFI_VARIABLE_APPEND_WRITE attribute to the variable's current attributes. This is what DeleteCert() does already. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>