Search code examples
certificatekerneldriversigning

Which one should I prefer, regular or EV code signing certificate?


I want to sign my driver, and I've taken a look to MSDN, and seen this: https://learn.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate

They say:

If you don’t have an approved EV code signing certificate, you can buy one from one of the certificate authorities below.

Does that mean I should only buy EV code signing certificate to sign my driver, or regular one can be enough as well? What are the bad/good sides? Thanks.


Solution

  • Yes you need an EV certificate, as stated in the link you shared:

    Microsoft requires an extended validation (EV) code signing certificates from partners enrolled and authorized for Kernel Mode Code Signing as part of the Microsoft Trusted Root Certificate Program.

    Tim Roberts answer on social MSDN might clarify the process:

    You can get Microsoft's signature in two ways: by running the WHQL tests and submitting the test results, or by submitting your driver package for attestation signing. Both of those things require that you submit your driver through the "developer hardware dashboard". The problem is that creating a "developer hardware dashboard" account requires an EV certificate.