内核模式代码签名
我做了一个驱动程序，现在我需要签名。它在内核模式下运行。
根据我在 Microsoft 的 内核模式代码签名演练，我必须从商业 CA 购买软件发行商证书。在该文档中，他们说要查看末尾，然后按照此链接< /a> 获取我可以购买该证书的 CA 列表。我发现该链接非常令人困惑，因为我无法确切地弄清楚我需要购买什么证书。我需要对驱动程序进行签名，以便它可以安装在 64 位 Windows 系统上。非常欢迎直接链接（我想从 GlobalSign 购买）。
是来自此处的 Microsoft Authenticode 吗？
I made a driver, and now I need to sign it. It runs in kernel mode.
From what I've read in Microsoft's Kernel Mode Code Signing Walkthrough, I have to buy a software publisher certificate from a commercial CA. In that document, they say to look at the end, and follow this link for a list of CAs from which I can buy that certificate. I find the link very confusing somehow because I can't figure out exactly what certificate I need to buy. I need to sign the driver so that it will install on 64-bit Windows systems. A direct link would be very welcome (I would like to buy it from GlobalSign).
Is it the Microsoft Authenticode from here?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我前段时间在微软驱动开发者论坛上问过类似的问题。这是他们的答案：
您的链接在支持的平台中包含此信息：通过 Authenticode 对 Windows ActiveX 控件进行数字签名（32 位和 64 位）位 .exe、.ocx、.dll 或其他）和 Windows 内核软件。兼容 Windows 7。
看来您来对地方了。
准确的说：我还没有使用过代码认证，我刚刚学习。我建议您在 osronline 或 Microsoft 驱动程序开发人员论坛中验证此答案。
I asked a similar question in Microsoft Drivers Developers Forum some time ago. This is their answer:
Your link contains this information in Supported Platforms: Digitally sign Windows ActiveX controls via Authenticode (32 bit and 64 bit .exe, .ocx, .dll or other) and kernel software for Windows. Windows 7 compatible.
It looks like you are in the right place.
Just to be precise: I have not used the code certification yet, I just learned it. I recommend you to verify this answer in osronline or Microsoft Drivers Developers Forum.
查看 https://www.startssl.com/?app=40 - StartSSL 提供此类证书价格为 199.00 美元
交叉签名的 CA 证书位于 https://www.startssl.com/certs/< /a> 命名为 microsoft.kernel.mode.pem 或 microsoft.kernel.mode.crt
Check out https://www.startssl.com/?app=40 - StartSSL offers such certificates for US$ 199.00
The cross-signed CA certificate is at https://www.startssl.com/certs/ named microsoft.kernel.mode.pem or microsoft.kernel.mode.crt
您可以从 Digicert 购买签名。
Digicert 将颁发 zip 文件中的交叉签名证书。解压它
DigiCert 高保证 EV 根 CA.crt
双击它并将其添加到您的 IE 个人存储
使用 IE，将证书和密码导出到 .pfx 文件 对
驱动程序进行签名的命令是
signtool sign /t http://timestamp.digicert.com /f ".pfx 文件路径" /p PASSWORD_OF_PFX "驱动程序 .cat 文件路径"
您可以使用相同的命令来签署 .exe 文件
signtool sign /t http://timestamp.digicert.com /f ".pfx 文件路径" /p PASSWORD_OF_PFX “驱动程序 .exe 文件的路径”
确保该计算机可以访问互联网，否则签名过程将失败。
You can buy a signature from Digicert.
Digicert will issue a cross signing certificate in a zip file. Unzip it
DigiCert High Assurance EV Root CA.crt
Double click it and add it to your IE personal store
Using IE, export the cert, with password to a .pfx file
The command to sign the driver is
signtool sign /t http://timestamp.digicert.com /f "path to .pfx file" /p PASSWORD_OF_PFX "path to driver .cat file"
You can use this same command to sign .exe files
signtool sign /t http://timestamp.digicert.com /f "path to .pfx file" /p PASSWORD_OF_PFX "path to driver .exe file"
Ensure this machine has internet access otherwise the signing process will fail.