Signing kernel mode driver on windows platform

0
votes

I have a 64 bit PCI KMDF driver(kernel-mode) developed using Visual Studio 2017 on windows 10. The driver is built with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform.

The driver is to be installed on Windows 10(1809).

As part of building, the driver file(.sys) and catalog(.cat) file automatically get signed by the system generated certificate. My problem is

  1. I want to remove system generated certificate from both files.The files should not get signed as part of driver build process. So if there is any switch option that i can use to prevent signing as part of the build process, that would be helpful.

  2. The driver shall be installed on a device which would be distributed to customers world over. For this deployment scenario, what is the requirement on the signing procedure for the driver? Does it have to be done through Windows Hardware Developer Center Dashboard portal (Dev Portal)? Is EV Code signing required for it?

1
windowsdriverdevicesigningkmdf
Also note that additional signatures can be added after the fact. I've seen drivers that still have their local dev-signed cert, and then is later resigned with the fully trusted code signing cert before release. - josh poley

1 Answers

1
votes

#1, you have an option in the project file to stop singing or to use a different certificate, see example here and documentation.

enter image description here

#2, if you want your driver to load on the latest windows 10 builds (without using test mode or other registry tweaks) and also you want your driver to load on the system with Secure boot you must get a Microsoft signed driver. for that, you must buy an EV Code signing for more info refer to "Signing a Driver for Public Release" page