Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company is developing driver for our hardware. Now I need to sign my driver for 32 and 64 bit platforms.

Please tell, now I need to buy Authenticode certificate, right?

What CA to use?

GlobalSign? ( )
Symantec? ( )

What is the difference between this CA offers?

I need to use tools from WDK?

share|improve this question

closed as too broad by gnat, Bart van Ingen Schenau, MichaelT, GlenH7, Kilian Foth Apr 28 '14 at 15:13

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

Please don't cross post – ChrisF Sep 19 '12 at 16:30
up vote 5 down vote accepted

Yes, you'll need a code signing or Authenticode certificate. (It looks like not all CA vendors call it an Authenticode certificate; GoDaddy, for example, simply calls it a driver signing certificate.)

As far as I know, with one major exception (see below), there is very little difference between CA vendors, and I'd generally just recommend using whoever's cheapest. Our Authenticode certificate is through Verisign / Symantec; I don't have experience with the other vendors. From my shopping around for regular (not code signing) SSL certificates, it seemed that companies like Verisign charged a premium just because they were better known. (It's possible that they have better security or perform more verification on their customers or similar, but the whole CA infrastructure is only really as strong as its weakest link, so that doesn't provide much benefit even if it's true.)

Update: The one major exception, as Brian points out, is that a certificate from Symantec / VeriSign in particular is required for features like Windows Error Reporting and Windows Hardware Certification, so if you want to use those features, you might as well buy VeriSign. (This is discussed further on Stack Overflow.)

Once you get your certificate:

  1. If necessary, run inf2cat to create or update your .cat file from your driver's .inf file.
  2. Run signtool signwizard (for the GUI mode) or signtool with the appropriate command-line arguments to sign the .cat file.

inf2cat is part of the Windows Driver Kit (WDK). signtool comes with the Platform SDK and the WDK.

The following web sites were useful to me when I was working on driver signing:

share|improve this answer

If you just want to be allowed to install a driver on a windows machine, your CA use shouldn't matter (unless the CA isn't trusted by Microsoft).

However, only VeriSign certificates are supported as a means of identifying your organization to Microsoft for features like Windows Error Reporting and Windows Hardware Certification. E.g., the Manage Your Digital Certificates page explicitly states to buy your certificate from VeriSign.

If you plan to make use of such functionality, you should buy a VeriSign certificate now rather than another certificate now and a VeriSign certificate later.

share|improve this answer
I remember reading this now, and I think this is why we went with VeriSign for our cert. There's further discussion on SO on the VeriSign-only requirement. – Josh Kelley Sep 19 '12 at 15:31

You need a certificate which satisfies the kernel mode code signing policy (KMCS).

Here is a MSDN list of possible certificate authorities.

BUT, it seems WHQL (or how it is currently called) needs a Verisign certificate to allow you participation in the WHQL program for windows logo ... things .... So I would buy a Verisign certificate if a windows logo is needed in the future.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.