Thawte driver signing for 64-bit Windows

6
votes

If this question is off-topic, please recommend another StackExchange site to post this on :-)

Our company recently purchased G2 code signing certificate from Thawte. I've run through all steps neccessary to sign a 64-bit driver, so it can be installed under Windows 7 64-bit.

Namely, I have:

  • downloaded a G2 Thawte cross-certificate
  • obtained our own Thawte certificate (actually a .p12 file which I had to import and re-export as .pfx file for it to work)
  • successfully signed the driver via the following command: signtool.exe sign /ac cross.cer /f private_key.pfx /p ***** /t "http://timestamp.verisign.com/scripts/timstamp.dll" /v my_driver.sys
  • imported our company certificate (and even all those Thawte certificates when the first didn't work) into machine's trusted root authorities and trusted publishers
  • importted thawte cross-certificate into Intermediate Certification Authorities

I've tried to verify the signature using signtool.exe verify /pa /v my_driver.sys, which has passed. If I do not use /pa in the command line, this would say "SignTool Error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider." (is that something I should be worried about?)

Now when I try to install the driver using a simple INF file (not a cab file), the result is red warning about Windows not being able to verify the issuer of the driver. When I choose not to install the driver, I get a following extra message: A file could not be verified because it does not have an associated catalog signed via Authenticode(tm).

I've read that Thawte could not really be used to sign drivers like this in the past because somehow MS stopped to support it, yet it's still listing a cross-certificate on their website. Not sure if this is still valid, cannot find any proof of it.

Any advice would be greatly appreciated.

1
securitycode-signingcode-signing-certificate
Please pick only one SE site. Ask for the question to be migrated if necessary. security.stackexchange.com/q/14568/2435 – Bruno
is there any official way to ask for migration? I couldn't fine one... – Zathrus Writer
do you have the thawte cross certificate installed? see msdn.microsoft.com/en-us/windows/hardware/gg487315 – msam
AFAIK Verisign and GlobalSign are the only CAs that issue certificates, usable for driver signing (i.e. the cross-certificate is provided for them). – Eugene Mayevski 'Callback
Eugene, where does your information come from please? I'd like to see some source of this, since I've heard that myself but can't seem to find any proof ... and yes, I have the cross-certificate installed – Zathrus Writer

1 Answers

5
votes

You need to add a CatalogFile reference to your inf file, run Inf2Cat.exe (in the DDK) to generate the cat file, then use signtool.exe to sign that too.