question

SteveChang-8853 avatar image
0 Votes"
SteveChang-8853 asked JennyFeng-MSFT commented

Kernel mode driver signing issue

Dear MS team, We develop kernel mode driver for our products for Windows platform. This driver then use DigiCert certificates to sign in. Microsoft has listed DigiCert certificate download link and we do follow it to get signed by Microsoft. But on this list ( https://docs.microsoft.com/en-us/windows-hardware/drivers/install/cross-certificates-for-kernel-mode-code-signing ), it show that the certificate download will be terminated by April,15 2021. I have checked with DigiCert and they said it is Microsoft's decision what will be next step. They can't provide this kernel-mode driver signing certificate any more. Therefore, this is to ask Microsoft if there is any guideline for kernel-mode driver signing certificate after April,15 2021. Thanks, Steve Chang

windows-10-securitywindows-server-securitywindows-hardware-certificationwindows-hardware-code-general
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JennyFeng-MSFT avatar image
0 Votes"
JennyFeng-MSFT answered SteveChang-8853 commented

@SteveChang-8853
Hi,
This Cross Certificate will expire on April 2021 and Microsoft will not be issuing trusted Cross Certificates for this purpose anymore.
You will need to follow the new Kernel Mode driver signing process which requires an EV Code Signing Certificate. OV/ Standard Code Signing using the Cross Certificate will no longer be applicable.
 
Registration for the Microsoft Hardware Program is required, this can be done in the Microsoft Hardware Dev Center. This way you can register your EV Certificate for further use in signing Kernel Mode driver packages.
Driver packages signed with the registered EV Certificate can then be submitted using signtool.exe.

Hope above information can help you.

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

If Cross Certificate is deprecated, according to the answer, we need to register our EV certificate in Dev Center account for kernel-mode code signing. The question is how do I know I am using the right EV Certificate? What EV Certificate we need to purchase? any provider or requirement needed?

Thanks

0 Votes 0 ·
CymonKilmer-4330 avatar image
0 Votes"
CymonKilmer-4330 answered JennyFeng-MSFT commented

Please review the documentation here that explains more about the EV cert and where to obtain it.
https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate


· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Here are two links. The information seems not consistent for cross-certificate kernel-mode driver
1. https://docs.microsoft.com/en-us/windows-hardware/drivers/install/deprecation-of-software-publisher-certificates-and-commercial-release-certificates#what-will-happen-to-my-existing-signed-driver-packages
2. https://docs.microsoft.com/en-us/windows-hardware/drivers/install/cross-certificates-for-kernel-mode-code-signing

It said cods-certificate kernel mode driver will be expired by July 1, 2021 on the 1st link. The 2nd link shows the new certificate (4 items) still can be used until its expiration date (2023). Which one is the correct? We are confused. Should we till need to purchase EV code-signing certificate for kernel-mode driver signing?


0 Votes 0 ·

If this problem is more urgent for you I still recommend that you open a case to Microsoft for further professional help.
https://support.microsoft.com/en-us/help/4341255/support-for-business

0 Votes 0 ·