How do I find out which certificate a windows driver uses for signature verification? I'm looking at usbhub.sys in particular (official windows driver).
Right click on usbhub.sys file, seclect Properties, then Digital Signatures, then Details and finally View Certificate.
Related
I am reading Microsoft documentation on how to sign a driver for windows 10 X64 and I am getting different information from the Microsoft website.
This document explains how to sign a driver by the developer without the need to send it to Microsoft.
This document explains how to submit the driver to Microsoft for signing.
and on other sites, the information is very different.
I need to sign my driver which I will send alongside my hardware to the user (so no need to be part of the windows update).
How can I sign it? which procedures should I follow and which certificate should I buy?
I'm trying to load a kernel driver that's been signed with a certificate generated by MakeCert.exe.
I followed the instructions given in the Windows Driver Kit documentation:
Sign the driver with MakeCert.exe
Verify the signature with SignTool verify /v /pa DriverFileName.sys.
Installing the cert into the test computer's Trusted Root Certification Authorities store and Trusted Publishers store, using CertMgr.exe
When I verify the signature with SignTool verify /v /pa DriverFileName.sys as described in WDK Microsoft Docs, SignTool reports that the signature is ok. I've done this on both the development computer and the test machine that is supposed to load the driver.
However, the driver doesn't actually load. The Windows CodeIntegrity log says 3004: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\path\DriverFileName.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
I looked at this similar question. I get the same results as in that question, when I run SignTool verify /v /kp DriverFileName.sys. It says: SignTool Error: Signing Cert does not chain to a Microsoft Root Cert.
The linked question's resolution involved using a real, non-test certificate, and changing the signing setup so that it correctly chained to the Microsoft Root Certificate. I'm not yet at that stage; I just want to get my test infrastructure working "properly".
I'm interested in having the kernel load my driver, and verify the signature using the certificates that I've manually installed on the test machine. I know I can use bcdedit -set testsigning yes to disable signature validation entirely, but that seems like overkill - it will allow any signed driver to run, even if it wasn't signed with the test certificate I've installed on the machines. Is it possible to leave "testsigning" mode turned off (so the driver signature is still actually validated against an installed cert), but still use my internal self-generated MakeCert.exe test certificate?
It looks the answer is no, it's not possible.
Can I install self-signed drivers on 64-bit Windows without test mode if the self-signed CA root certificate is imported to the machine store?
The WDK documentation seems quite misleading. Installing the certificate generated by MakeCert.exe on x64 test machines seems to be entirely pointless, since the kernel never pays any attention to it.
If TESTSIGNING mode is on, the signature isn't validated, so the cert doesn't need to be installed.
If TESTSIGNING mode is off, the self-signed certificate isn't cross-signed by anything the kernel trusts, so it's not considered valid, so installing the cert doesn't help.
I'm happy to accept corrections.
We have been using an Authenticode code signing certificate from Globalsign for years to sign our Windows 7 drivers. Since now there is a move towards new "SHA-256" code signing certificates, we got such a new certificate which works fine under Windows 8.1 or 10, but not under Windows 7.
When I install the driver, Windows ask me if I trust the publisher and offers the checkbox "always trust this publisher", i.e., it offers to save this selection for future installations. However, under Windows 7 this no longer works, i.e., I get asked every time I install the driver.
I guess this is a bug in Windows 7. Has anyone else experienced this? Is there any solution?
Yes, I've experienced exactly the same issue, which is not very convenient when you're trying to install a driver package automatically from the command-line, for instance...
And yes, there is a solution which fixed this for me, you can find a hot-fix on the Microsoft support website here.
It is not directly available, but you just have to enter your e-mail address in the form and Microsoft will send it to you.
I am trying to code sign a driver in Windows (drivers for a video capture card). I have the inf, cat, sys files for this driver. I have followed various Windows articles and so far am able to:
1) Download a "DER" file from GoDaddy and then create a "mycompanyinc.cer"
2) Use signtool to sign the .cat, .sys drivers
3) verified the .cat, .sys driver files are updated with digital certifiates.They correctly stated that its issued to "my company" and issued by "go daddy CA". I exported the above certificate to a ".cer" and put on a different computer
I used MMC to make sure it shows up in the Trusted Root Certificate Authorities on the system where I need to install the drivers. While there driver file shows correctly the information "issued by" ,"issued to" etc. Windows is still complaining during drivers install that the digital signature can't be verified.
Any help, direction in this matter will be greatly appreciated.
thanks!
Since 2016 Microsoft require a longer process along with an EV Code Signing Certificate for signing drivers.
They explain it in this article.
I want to edit/change driver signature. Because when i start it, I got message, that signature isn't set. The only option now is to click F8 and then "Disable driver signature enforcement". But I don't really want to use this option, it's insecure. So how I can set signature for that driver? Or maybe disable driver signature enforcement for ONLY selected driver? Any ideas?
Thanks
If you purchase a code signing certificate from Verisign or Globalsign (other CAs won't work), you can remove existing signature if it's present for the driver and then apply your own signature by signing the driver file. Signing is done using signtool.exe from Windows SDK or from Windows Driver Kit. When the driver is signed, you need to include a cross-signing certificate.