Driver Signing

​

Overview

​

Signing Methods

​

Test Signing for Development

​

When to Use Test Signing

• Local development and debugging
• Internal testing
• Non-production environments
• Learning driver development

​

Creating a Test Certificate

# Open Developer Command Prompt for Visual Studio as Administrator

# Create a test certificate
makecert -r -pe -ss PrivateCertStore -n "CN=VDD Test Certificate" TestCert.cer

• -r - Create self-signed certificate
• -pe - Mark private key as exportable
• -ss PrivateCertStore - Certificate store name
• -n "CN=..." - Certificate subject name

​

Installing the Test Certificate

# Run as Administrator
certmgr.exe /add TestCert.cer /s /r localMachine root
certmgr.exe /add TestCert.cer /s /r localMachine trustedpublisher

1. Run certmgr.msc as Administrator
2. Right-click Trusted Root Certification Authorities → Certificates
3. Select All Tasks → Import
4. Browse to your .cer file and import
5. Repeat for Trusted Publishers

​

Enabling Test Signing Mode

# Run as Administrator
bcdedit /set testsigning on

bcdedit /set testsigning off
# Reboot required

​

Signing the Driver Package

# Navigate to your build output directory
cd "Virtual Display Driver (HDR)\MttVDD\x64\Debug\MttVDD"

# Sign the catalog file
signtool sign /v /s PrivateCertStore /n "VDD Test Certificate" /t http://timestamp.digicert.com MttVDD.cat

# Sign the driver binary
signtool sign /v /s PrivateCertStore /n "VDD Test Certificate" /t http://timestamp.digicert.com MttVDD.dll

• /v - Verbose output
• /s PrivateCertStore - Certificate store name
• /n "..." - Certificate subject name
• /t http://... - Timestamp server URL

​

Verifying Signature

signtool verify /v /pa MttVDD.cat
signtool verify /v /pa MttVDD.dll

​

Production Signing

​

Requirements for Public Distribution

1. Extended Validation (EV) Code Signing Certificate
   • Must be from a Microsoft-trusted Certificate Authority
   • Hardware token (USB) required for EV certificates
   • Costs typically $200-$400/year
2. Windows Hardware Compatibility Program
   • Submit driver to Microsoft Hardware Dev Center
   • Driver tested and signed by Microsoft (attestation signing)
   • Free but requires approval

​

Getting an EV Code Signing Certificate

• DigiCert
• Sectigo (formerly Comodo)
• GlobalSign
• Entrust

1. Purchase EV Code Signing Certificate from CA
2. Complete identity verification (requires legal business documents)
3. Receive hardware token with certificate
4. Install certificate on development machine

​

SignPath.io for Open Source Projects

• Free code signing service
• Integrates with GitHub Actions
• Provides trusted certificates
• See SignPath documentation for setup

​

Microsoft Hardware Dev Center Signing

1. Register:
   • Create account at Microsoft Hardware Dev Center
   • Requires EV Code Signing Certificate
2. Prepare Driver Package:
   # Create .cab file for submission
   makecab MttVDD.inf MttVDD.cab
   
3. Submit for Attestation:
   • Upload .cab file to Dev Center
   • Microsoft validates and signs the driver
   • Download signed package
4. Distribution:
   • Microsoft-signed drivers install without test mode
   • Compatible with all Windows versions

​

Signing in Visual Studio Build Process

​

Automatic Signing Configuration

1. Right-click project → Properties
2. Navigate to Driver Signing → General
3. Set Sign Mode to “Test Sign”
4. Set Test Certificate to your certificate
5. Apply and rebuild

​

Project File Configuration

<DriverSign>
  <FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
</DriverSign>

• Debug builds: SHA1 (faster, test signing)
• Release builds: SHA256 (production standard)

​

ARM64 Signing Considerations

1. Enable test signing mode (as described above)
2. Sign driver with test certificate
3. Alternatively, obtain Microsoft attestation signature

​

Signature Verification

​

Manual Verification

# Verify catalog signature
signtool verify /v /pa MttVDD.cat

# Verify driver binary signature
signtool verify /v /pa MttVDD.dll

# Check signature details
signtool verify /v /pa /all MttVDD.dll

​

Windows UI Verification

1. Right-click MttVDD.dll → Properties
2. Navigate to Digital Signatures tab
3. Select signature and click Details
4. Verify certificate chain and validity

​

Driver Installation Verification

# Check driver signature status
pnputil /enum-drivers

​

Security Best Practices

​

Certificate Protection

• Store EV certificates on hardware tokens only
• Never share certificate private keys
• Use certificate password protection
• Limit certificate access to trusted build systems
• Revoke compromised certificates immediately

​

Test Signing Security

• Only enable test signing on isolated development machines
• Disable test signing when not actively developing
• Never distribute drivers signed with test certificates
• Remove test certificates when development is complete

​

Timestamp Servers

• DigiCert: http://timestamp.digicert.com
• Sectigo: http://timestamp.sectigo.com
• GlobalSign: http://timestamp.globalsign.com

• Signature remains valid after certificate expires
• Proves signing time
• Required for long-term validity

​

Troubleshooting

​

Error: “The signature is invalid”

1. Re-sign with correct certificate
2. Verify certificate is in Trusted Root
3. Check timestamp server connectivity

​

Error: “Windows cannot verify the digital signature”

1. Enable test signing: bcdedit /set testsigning on
2. Install certificate to Trusted Root and Trusted Publishers
3. Reboot

​

Error: “The specified store to be opened cannot be found”

​

Driver Installation Fails with Code 52

1. Check Device Manager → Driver Properties → Events
2. Verify signature with signtool verify
3. Ensure all required certificates are installed
4. Enable test signing if using test certificate

​

Next Steps

​

Additional Resources

• Driver Signing Requirements - Microsoft Docs
• SignTool Documentation
• Windows Hardware Dev Center
• Test Signing - WDK Documentation