Yes, you'll need a code signing or Authenticode certificate. (It looks like not all CA vendors call it an Authenticode certificate; GoDaddy, for example, simply calls it a driver signing certificate.)
As far as I know, with one major exception (see below), there is very little difference between CA vendors, and I'd generally just recommend using whoever's cheapest. Our Authenticode certificate is through Verisign / Symantec; I don't have experience with the other vendors. From my shopping around for regular (not code signing) SSL certificates, it seemed that companies like Verisign charged a premium just because they were better known. (It's possible that they have better security or perform more verification on their customers or similar, but the whole CA infrastructure is only really as strong as its weakest link, so that doesn't provide much benefit even if it's true.)
Update: The one major exception, as Brian points out, is that a certificate from Symantec / VeriSign in particular is required for features like Windows Error Reporting and Windows Hardware Certification, so if you want to use those features, you might as well buy VeriSign. (This is discussed further on Stack Overflow.)
Once you get your certificate:
- If necessary, run
inf2cat to create or update your
.cat file from your driver's
signtool signwizard (for the GUI mode) or
signtool with the appropriate command-line arguments to sign the
inf2cat is part of the Windows Driver Kit (WDK).
signtool comes with the Platform SDK and the WDK.
The following web sites were useful to me when I was working on driver signing: