Windows Kernel-Mode Code Signing for Drivers

What Is a Windows Kernel-Mode Driver Signing Certificate?

A Windows kernel-mode code signing certificate is a tool that allows you to sign the drivers at the heart of your device’s operating system. More specifically, it’s a small file that protects your Windows driver and/or driver package against unauthorized alterations and proves its authenticity to device operating systems.

Why is this important? Because the certificate is issued by a trusted third party (i.e., a certificate authority, or CA for short). The CA attests that your digital identity is accurate — that you are who you say you are — after thoroughly vetting you and/or your organization. It then issues a code signing certificate you can use to sign driver packages and files so you can attach your digital identity to the driver.  

How to Ensure Your Kernel-Mode Drivers Are Trusted By Windows Operating Systems

For a driver to be digitally signed and trusted by various Windows operating systems as Windows Certified, it must be certified as meeting specific security, compatibility, and functionality and Windows Hardware Compatibility Program requirements. Once you have developed your driver, you must:

• Purchase an extended validation code signing certificate from a trusted source.
• Sign up for a Microsoft Windows Hardware Developer Program account and upload your EV certificate to the Dev Portal.
• Go through Microsoft’s driver signing process, which includes digitally signing your driver files or package using the EV code signing certificate.
• Test your driver. For a driver to be eligible for the Windows Certification, you also must run tests using the appropriate test framework for the Windows operating system you’re creating the driver for:
  • Windows Hardware Lab Kit (HLK) or virtual HLK for Windows 10 or later OS versions,
  • Windows Hardware Certification Kit (HCK) for Windows version 8.1 or earlier OS versions, or
  • Windows Logo Kit (WLK) hardware submission package for the 2008 or older versions of Windows Server.
• Submit your signed kernel-mode driver to the Windows Hardware Developer Center to be reviewed (if necessary) and digitally signed by Microsoft. Click on the previous link to learn more about Microsoft’s driver submission, publishing, and distribution processes.

How to Use a Windows Kernel Mode Code Signing Certificate

An extended validation (EV) code signing certificate must be uploaded to Microsoft for verification before the tech giant will sign your driver. Why? Because kernel-mode drivers are privileged software components that operate at your device’s core operating system level. They enable critical systems and devices to communicate and do their jobs.

Typically, these drivers require signing by using an EV code signing certificate. The signed driver must then be uploaded to the Microsoft Hardware Dev Center dashboard for review, where it’ll then be signed by a Microsoft CA certificate.