Windows driver signing

Question

My company is developing driver for our hardware. Now I need to sign my driver for 32 and 64 bit platforms.

Please tell, now I need to buy Authenticode certificate, right?

What CA to use?

DigiCert?
GlobalSign? ( http://www.sslshopper.com/microsoft-authenticode-certificates.html )
Symantec? ( http://www.symantec.com/verisign/code-signing/microsoft-authenticode )

What is the difference between this CA offers?

I need to use tools from WDK?

Answer 1

Yes, you'll need a code signing or Authenticode certificate. (It looks like not all CA vendors call it an Authenticode certificate; GoDaddy, for example, simply calls it a driver signing certificate.)

As far as I know, with one major exception (see below), there is very little difference between CA vendors, and I'd generally just recommend using whoever's cheapest. Our Authenticode certificate is through Verisign / Symantec; I don't have experience with the other vendors. From my shopping around for regular (not code signing) SSL certificates, it seemed that companies like Verisign charged a premium just because they were better known. (It's possible that they have better security or perform more verification on their customers or similar, but the whole CA infrastructure is only really as strong as its weakest link, so that doesn't provide much benefit even if it's true.)

Update: The one major exception, as Brian points out, is that a certificate from Symantec / VeriSign in particular is required for features like Windows Error Reporting and Windows Hardware Certification, so if you want to use those features, you might as well buy VeriSign. (This is discussed further on Stack Overflow.)

Once you get your certificate:

1. If necessary, run inf2cat to create or update your .cat file from your driver's .inf file.
2. Run signtool signwizard (for the GUI mode) or signtool with the appropriate command-line arguments to sign the .cat file.

inf2cat is part of the Windows Driver Kit (WDK). signtool comes with the Platform SDK and the WDK.

The following web sites were useful to me when I was working on driver signing:

• https://knowledge.verisign.com/support/code-signing-support/index?page=content&id=AR190
• http://msdn.microsoft.com/en-us/windows/hardware/gg487328.aspx
• http://msdn.microsoft.com/en-us/library/ff544865%28v=vs.85%29.aspx

Answer 2

If you just want to be allowed to install a driver on a windows machine, your CA use shouldn't matter (unless the CA isn't trusted by Microsoft).

However, only VeriSign certificates are supported as a means of identifying your organization to Microsoft for features like Windows Error Reporting and Windows Hardware Certification. E.g., the Manage Your Digital Certificates page explicitly states to buy your certificate from VeriSign.

If you plan to make use of such functionality, you should buy a VeriSign certificate now rather than another certificate now and a VeriSign certificate later.

Answer 3

You need a certificate which satisfies the kernel mode code signing policy (KMCS).

Here is a MSDN list of possible certificate authorities.

BUT, it seems WHQL (or how it is currently called) needs a Verisign certificate to allow you participation in the WHQL program for windows logo ... things .... So I would buy a Verisign certificate if a windows logo is needed in the future.