How to sign my driver so it will install on Window

问题:

I have a kernel mode driver and I have to install t on 64 bit Windows 7. It needs to be digitally signed. I digitally signed it using the dseo13b.exe. But when I load the driver I get an error in the system event log saying:

The driver failed to start due to the following error:
Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

I don't want to use the testsigning mode. How do I resolve this? Do I need to get a certificate from Microsoft?

I have developed the driver and am now making it work on the 64 bit machine...

回答1:

Only for 64 bit builds: setting up self signing

Part 1: creating and installing the test certificate

1. Launch an elevated command line shell (Vista and later).
2. makecert.exe -r -pe -ss my -n "CN=MyTestCertificate" mytestcert.cer
3. certmgr.exe -add mytestcert.cer -s -r localMachine root
4. Start certmgr.exe and check that "MyTestCertificate" is listed both under "Personal" and "Trusted Root Certification Authorities".
5. Keep the mytestcert.cer file in a safe place.

Part 2: configuring the system to run test signed code (Vista and later)

1. Launch an elevated command line shell (Vista and later).
2. Run Bcdedit.exe -set TESTSIGNING ON on an elevated cmd.exe prompt.
3. certmgr.exe -add mytestcert.cer -s -r localMachine root
4. certmgr.exe -add mytestcert.cer -s -r localMachine trustedpublisher
5. Reboot.
6. Vista: "Test Mode" will appear in all four corners of the desktop and "Microsoft (R) Windows (R) (Build 6000)" will appear on the top. Windows 7: "Test ModeWindows 7Build 7600" will appear in the lower right corner.

回答2:

Two useful resources to sign drivers

Windows 7

Windows Server 2012 and Windows 8.1(kind of)

summery:

1.Get a RSA certificate from(Digicert or Verisign or anywhere in your budget) or create a certificate yourself if you need to install it only in your computer

2.When you have a certificate you will also have a private key

3.To distribute the driver you need this certificate to be traceable, Microsoft uses a system called Trusted Root Certification Authority.Now there are other authorities that gives certificate beside these but they will need windows update to verify those. type certmgr.msc to get the list. And look for the ones with code signing permission

4.Either add the certificate in that list or get a certificate from that list

5.Sign the driver with the certificate[details in the links above]

6.Now distribute the driver

there are many tutorials in internet for signing a driver. NB: WHQL is a pricey option you can consider if your company can manage to pay

回答3:

All you should need is a trusted certificate (signed by Verisign, Thawte, etc.).

Look through these resources:

• Driver Signing Requirements for Windows (MSDN)
• Kernel-Mode Code Signing Walkthrough (MSDN)