Windows OS Hub
  • Windows Server
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Group Policies
  • Windows Clients
    • Windows 10
    • Windows 8
    • Windows 7
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
  • PowerShell
  • Exchange
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Group Policies
  • Windows Clients
    • Windows 10
    • Windows 8
    • Windows 7
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
  • PowerShell
  • Exchange

 Windows OS Hub / Windows 10 / How to Sign an Unsigned Driver for x64 Windows 10, 8.1 or 7 with a Self-signed Certificate

July 26, 2018 Windows 10Windows 7

How to Sign an Unsigned Driver for x64 Windows 10, 8.1 or 7 with a Self-signed Certificate

By default, all 64-bit Windows versions, starting from Windows 7, prohibit to install devices drivers that are not signed with a valid digital signature. Unsigned drivers are blocked by the operating system. The digital signature guarantees (to some extent) that the driver has been released by a certain developer or vendor, and its code hasn’t been modified after it was signed.

In 64-bit (x64) Windows 10, 8.1 and 7 there are several ways to disable driver signature verification for the unsigned drivers: using a group policy or a test boot mode. Today we’ll show how to sign any unsigned driver for the 64-bit version of Windows 10 or Windows 7.

Suppose you have a certain unsigned device driver (without digital signature) for Windows 10 x64 or Windows 7 x64. In this example, it is the driver for quite old graphics card. The archive with drivers for your Windows version has been downloaded from the vendor’s website (I was able to find the video driver version for Windows Vista x64) and its contents has been extracted to c:\tools\drv1\. Let’s try to install the driver by adding it to Windows driver store with a standard pnputil tool:
Pnputil –a c:\tools\drv1\xg20gr.inf

Note. This command and all the next ones must be run in the command prompt as administrator.

During driver installation, Windows 7 displays a warning that the system can’t verify the digital signature of this driver:

Windows can’t verify the publisher of this driver software.

win7 x64 install unsigned driver

In Windows 10 this warning doesn’t appear, but a warning appears in the console:

Processing inf: xg20gr.inf
Adding the driver package failed: The third-party INF does not contain digital signature information.

Adding the driver package failed: The third-party INF does not contain digital signature information.

If you right click on the inf driver file and select Install when installing a driver from File Explorer, you receive an error:

installing driver from the inf file

The third-party INF does not contain digital signature information.

The third-party INF does not contain digital signature information.

Let’s try to sign this driver with a self-signed certificate.

Contents:
  • Tools for Signing Drivers
  • Create a Self-Signed Certificate and Private Key
  • Creating a Catalog File (CAT) for Driver Package
  • Signing the Driver Using Self-signed Certificate
  • Installing the Self-Signed Certificate
  • Installation of the Driver Signed with the Self-signed Certificate

Tools for Signing Drivers

To generate a signature and sign the driver, you need to download and install the following Windows application development tools (with the default settings):

  • Windows SDK (or Microsoft Visual Studio 2005 or later) for your version of Windows. These packages include Windows SDK Signing tools for Desktop, which includes the necessary utility – signtool.exe;
  • Windows Driver Kit 7.1.0.
Tip. In Windows 10 you can use the newer versions of Windows SDK and Windows Driver Kit. Before installing these tools, make sure that the .NET Framework 4 is installed on your computer.

Create a Self-Signed Certificate and Private Key

Create a C:\DriverCert folder in the root of the system drive.

Open the command prompt and go to the following directory:

cd C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1\bin

Create a self-signed certificate and private key, that is issued, for example, for the company WinOSHub:

makecert -r -sv C:\DriverCert\myDrivers.pvk -n CN="WinOSHub" C:\DriverCert\myDrivers.cer

During the creation of the certificate, the tool will prompt you to specify a password for the key, let it be P@ss0wrd.

create private key password

Create a public key for a publisher certificate (PKSC) we have created earlier:

cert2spc C:\DriverCert\myDrivers.cer C:\DriverCert\myDrivers.spc

Combine the public key (.spc) and the private key (.pvk) in a single certificate file with format Personal Information Exchange (.pfx):

pvk2pfx -pvk C:\DriverCert\myDrivers.pvk -pi P@ss0wrd -spc C:\DriverCert\myDrivers.spc -pfx C:\DriverCert\myDrivers.pfx -po P@ss0wrd

Tip. You can create a self-signed Code Signing certificate without using third-party tools by using the PowerShell 5.0 cmdlet – New-SelfSifgnedCertificate:

$cert = New-SelfSignedCertificate -Subject "Woshub” -Type CodeSigningCert -CertStoreLocation cert:\LocalMachine\My

Then you need to export this certificate to the pfx file with the password:

$CertPassword = ConvertTo-SecureString -String “P@ss0wrd” -Force –AsPlainText
Export-PfxCertificate -Cert $cert -FilePath C:\DriverCert\myDrivers.pfx -Password $CertPassword

New-SelfSignedCertificate create cert using powershell

Note. Although the certificate has a limited validity period, the expiration of the CodeSigning certificate means that you can’t create new signatures. The validity of the driver already signed by this certificate is unlimited (or old signatures are valid during the specified timestamp).

Creating a Catalog File (CAT) for Driver Package

Create the directory C:\DriverCert\xg20 and copy all files from the folder into which the driver from the archive has been originally extracted (c:\tools\drv1\). Make sure that there are files with the extensions .sys and .inf among these files (in our case, they are xg20grp.sys and xg20gr.inf).

Go to the directory:

cd C:\WinDDK\7600.16385.1\bin\selfsign

Generate a CAT file (contains information about all the files in the driver package) on the base of the INF file. On the base of an inf file using the inf2cat.exe tool (included in the Windows Driver Kit – WDK) generate a cat file for your platform (it contains information about all files in the driver package):

inf2cat.exe /driver:"C:\DriverCert\xg20" /os:7_X64 /verbose

inf2cat generating driver cat file

To make sure that the procedure was correct, check if the log file contains the messages:

Signability test complete.

Signability test complete.

and

Catalog generation complete.

Catalog generation complete.

Note. In my case the command Inf2Cat.exe returned an error:

Signability test failed.
Errors:
22.9.7: DriverVer set to incorrect date (must be postdated to 4/21/2009 for newest OS) in \hdx861a.inf

22.9.7: DriverVer set to incorrect date (must be postdated to 4/21/2009 for newest OS) in inf file

To fix the error, find the line with DriverVer = in the [Version] section and replace it with:

DriverVer=05/01/2009,9.9.9.9
inf file: DriverVer=05/01/2009,9.9.9.9

After the command is executed, the xg20gr.cat file should be updated in the drivers’ directory.

Signing the Driver Using Self-signed Certificate

Go to the following folder:

cd C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1\Bin

Sign the set of the driver files with the certificate you have created earlier using Globalsign as a timestamp service. The following command will sign the CAT file with a digital signature using with a certificate stored in a PFX file, protected by a password:

signtool sign /f C:\DriverCert\myDrivers.pfx /p P@ss0wrd /t http://timestamp.verisign.com/scripts/timstamp.dll /v C:\DriverCert\xg20\xg20gr.cat

signtool sign driver in windows 10 x64 using pfx cert file

If the file is successfully signed, the following message should appear:

Successfully signed: C:\DriverCert\xg\xg20gr.cat
Number of files successfully Signed: 1

Tip. The digital signature of the driver is contained in the .cat file referenced in the .inf file. You can check the digital signature of the driver in the cat file using the following command:

SignTool verify /v /pa c:\DriverCert\xg\xg20gr.cat

SignTool verify cat file digital signature

Or in the file properties on the Digital Signatures tab:

cat file digital signature

The CAT file contains digital signatures (thumbprints) of all the files that are in the driver directory (files listed in the INF file in the CopyFiles section). If any of these files has been changed, the checksum of the files will not match the data in the CAT file, and, as a result, the installation of such a driver will fail.

Installing the Self-Signed Certificate

Since the certificate we created is self-signed, by default the system doesn’t trust it. Add your certificate to the local computer certificate store. You can do it using the following commands:

certmgr.exe -add C:\DriverCert\myDrivers.cer -s -r localMachine ROOT
certmgr.exe -add C:\DriverCert\myDrivers.cer -s -r localMachine TRUSTEDPUBLISHER

Or do it with the graphical certificate import wizard (you need to place the certificate in the Trusted Publishers and Trusted Root Certification Authorities stores of the local machine). In a domain, you can distribute this certificate to client computer using Group Policy.

add certificate to truster publishers store

Note. You can check if the certificate we created is in the list of trusted certificated by opening the certificate management snap-in (certmgr.msc) and making sure that our certificate (issued for our company) is in the corresponding stores.

self signed cert in trusted root authorities

 

Tip. When you check the certificate store with the Sigcheck utility, this certificate will be displayed as untrusted, because it is not on the listed in the list of Microsoft root certificates (this list needs to be updated periodically).

Installation of the Driver Signed with the Self-signed Certificate

Try to install the driver we have signed again using the command:

Pnputil –i –a C:\DriverCert\xg20\xg20gr.inf

Now you won’t see the warning about the missing digital signature of the driver.

Successfully installed the driver on a device on the system.
Driver package added successfully.

pnputil install selfsigned device driver

The following warning appears in Windows 7 x64: Would you like to install this device software? In Windows 10 x64 1803, this pop-up window doesn’t appear.  By clicking “Install”, you install the driver in the system.

install self-signed driver in windows 7 x64

If for some reason the driver is not installed, the detailed driver installation log is contained in the file C:\Windows\inf\setupapi.dev.log. This log file allows you to get more information about the driver installation errors. In most cases, there is a “Driver package failed signature validation” error – most likely this means that the driver certificate is not added to the trusted certificates store.

setupapi.dev.log

If the driver installation was successful, the setupapi.dev.log file should contain the following lines:

>>>  [Device Install (DiInstallDriver) - C:\WINDOWS\System32\DriverStore\FileRepository\xg20gr.inf_amd64_c5955181214aa12b\xg20gr.inf]
>>>  Section start 2018/07/22 23:32:57.015
cmd: Pnputil  -i -a c:\DriverCert\xg\xg20gr.inf
ndv: Flags: 0x00000000
ndv: INF path: C:\WINDOWS\System32\DriverStore\FileRepository\xg20gr.inf_amd64_c5955181214aa12b\xg20gr.inf
inf: {SetupCopyOEMInf: C:\WINDOWS\System32\DriverStore\FileRepository\xg20gr.inf_amd64_c5955181214aa12b\xg20gr.inf} 13:23:37.046
inf:      Copy style: 0x00000000
inf:      Driver Store Path: C:\WINDOWS\System32\DriverStore\FileRepository\xg20gr.inf_amd64_c5955181214aa12b\xg20gr.inf
inf:      Published Inf Path: C:\WINDOWS\INF\oem23.inf
inf: {SetupCopyOEMInf exit (0x00000000)} 13:23:37.077
<<<  Section end 2018/07/22 13:23:37.155
<<<  [Exit status: SUCCESS]

As you can see, to install the self-signed driver we did not even have to disable the digital signature verification of the drivers with the bcdedit.exe commands:

bcdedit.exe /set loadoptions DISABLE_INTEGRITY_CHECKS
bcdedit.exe /set testsigning ON

28 comments
6
Facebook Twitter Google + Pinterest
previous post
VMware vSAN 6.5: FAQ and Cluster Configuration
next post
HP Printer Prints Only One Copy of Document

Related Reading

How to Disable NetBIOS and LLMNR Protocols in...

April 9, 2021

Enable Windows Lock Screen after Inactivity via GPO

April 8, 2021

Can’t Copy and Paste via Remote Desktop (RDP)...

March 31, 2021

UAC: This App Has Been Blocked for Your...

March 30, 2021

How to Unlock a File Locked by Any...

March 29, 2021

28 comments

Don D. March 9, 2015 - 12:33 pm

Unless you unable testmode (bcdedit /set testsigning on) to disable kernel drivers signature verification, Windows won’t allow the driver to load. You will not have the warning when installing the self-signed driver, but it won’t load.
I’ve tested it thoroughly, and it’s confirmed here and there.

Reply
Max March 11, 2015 - 8:03 am

You must add your self signed cert to Trusted Publishers and Trusted Root Certification Authorities containers in the local certificate store

Reply
Don D. March 11, 2015 - 12:16 pm

I followed very carefully all these instructions, and i’m sorry to say that it doesn’t work: Window won’t allow the driver to run if it doen’t have a cross-signed signature.

It is confirmed here:  minasi.com/newsletters/nws0903.htm

Mark Minasi: “Windows wants your cert to be cross-signed by Microsoft, which costs money, but you can tell Windows 7 (I’ve not tested Vista) to accept certs that aren’t signed by Microsoft with this command, executed from an elevated command prompt:
bcdedit /set testsigning on
This produces one side-effect:  Windows shows “Test Mode” in the lower right-hand corner of the desktop.”

Here:   ghisler.ch/board/viewtopic.php?t=24262&postdays=0&postorder=asc&start=15&sid=918bbb55edaeb08e6084af9d30a9ab5d

Flint: “I’ve read many discussions on programmers forums about the matter, everyone there confirmed that it was impossible to load unsigned or self-signed drivers in x64 (among those were many professionals, MVPs and driver programming experts).” (unless by enabling testmode, what is not recommanded because it is a security feature)

And here: msdn.microsoft.com/en-us/library/windows/hardware/ff544872%28v=vs.85%29.aspx
msdn.microsoft.com/en-us/library/windows/hardware/ff552299%28v=vs.85%29.aspx

I have also signed the driver itself (not only the cat file), to no avail.
I don’t know who made the test here, but this information is unaccurate: yes you won’t get a warning, the driver is installed, but it won’t be running.  

Reply
ary pramudito (@_tatox_) November 17, 2015 - 7:02 am

interesting. please comment on signing windows 10.  https://moln1.wordpress.com/2015/02/18/creating-self-signed-certificates-in-windows-10/

Reply
MarcK4096 July 22, 2016 - 8:12 pm

This worked great for me.  There’s a known problem with Ricoh print drivers in which defaults set on the print server do not propagate to clients.  Instead, Ricoh defaults need to be put into an RCF file included with the driver.  Editing the RCF file breaks the digital signature, which causes clients to refuse to install the driver downloaded from the print server.  Re-signing with a self signed certificate and distributing the certificate using group policy solved the problem.
Thanks so much for putting this article together.  You made it easy for me to complete a complex process.

Reply
MarcK4096 July 22, 2016 - 8:14 pm

And I did test with Windows 10.  It did work there, too.

Reply
SafetyLok November 7, 2016 - 2:20 am

Just wanted to say thanks for this.
I was able to self sign drivers for Win10 x64.  One trick to remember is on the target PC to import the certificate into the “trusted root certification authorities” for “Local Computer”. Using certmgr -add did not seem to import to Local Computer, only Current User.
Thanks

Reply
Brian December 12, 2016 - 10:18 pm

Thanks for this method of self-signing a driver which won’t install due to Windows 10 signed driver installation firewall.
I had a very difficult time installing the Windows 7 SDK in Windows 10 because it kept complaining about the version of .NET Framework 4 was an incomplete version and I couldn’t install .NET Framework 4 because a newer version, 4.6.2 is installed and nothing I tried could deinstall it. What I did was expand the Windows 7 SDK and manually installed all of the modules I could then ran the installer which enabled me to fully install the Windows 7 SDK as an installation repair. As well, it is not in the “Program Files (x86)” folder, it is in the “Program Files” folder so change the instructions by removing “(x86)” from the command strings. After all that, which took a long time to figure out, the rest was a breeze. The only problem was that the date of the driver stated in the “.inf” file had to be updated to 04/21/2009 (at least) because it was too old for Windows 7 as it predated Windows 7. Now the 64bit driver for myAOpen FM56-EXV external serial voice capable modem is fully loaded in Windows 10.

Reply
Jason January 1, 2018 - 3:15 pm

I tried the steps, and it does what it says — it gets rid of the warning message when using pnputil.
It doesn’t make the driver work.

To understand why see this table in David Grayson’s excellent article:
http://www.davidegrayson.com/signing/#reqs
While you’re making the steps to “make it look good” by adding a Trusted Root Certification Authority, you’re still missing a “Microsoft Code Verification Root” because your Trusted Root is not recognized by Microsoft.

Reply
bilbo July 27, 2018 - 9:10 am

Great link, thanks!

Reply
mach Fiverr February 19, 2021 - 11:15 am

I wish the guy had just put (insert your inf file to sign) in the how to instead of confusing the hell out of me by having me create a certificate for a driver and such weird names for stuff that I’m left unsure of which things I should change or commands to use for my libusb0.inf file im wanting to sign. FYI my laptop keyboard is broken I don’t have an external one and command line turn nointegritychecks or testsigning and others via elevated not elevated via PowerShell and every other way I can find or think of doesnt work and due to no keyboard I can’t tap option 7 and I can’t use my touchscreen or pad thingy u know mouse pad thing below keyboard. I’m at burnout stage from all this and installing this app that app searching for just makecert failing then installing the wrong version of visual studio on installing visual studio reinstalling the right version etc… Etc… Its 3am so no I can’t go buy a keyboard atm

Reply
Jens April 17, 2018 - 3:32 pm

You absolutely made my day!!! – Great Article. Worked for me like a charm! Thanks a lot for your input!

Reply
bilbo July 27, 2018 - 8:57 am

Please avoid to spread false informations on the web!
All this does not work and cannot work on 64bit Windows 10 (tested on a third-party PCSC kernel driver)

Reply
ant` August 6, 2018 - 3:34 am

Worked on Windows 10 ,1803 using the enterprise SDK. Obviously, some commands need to be changed and you have to add the ROOT cert to the store or this will not be trusted!!!

Reply
Alain G. October 13, 2018 - 4:30 pm

I can use multi-partitionned SD cards in Windows 10 1803 without any additional driver. Checked on Home and Pro versions.

Reply
TPMJB August 27, 2018 - 1:55 pm

This really only works if test mode is on when adding the cert to the trusted publishers and trusted root certification authority. So basically just have test mode on all the time. It’s better than rebooting every time you want to use it and disabling driver verification.

Reply
Vladimir December 25, 2018 - 5:44 am

Good day.
Where i can find inf2cat.exe? After install all needed software, in thus folder only hrml file with information that this process now is part of build process.
Windows 10 1803

Reply
Keith April 8, 2019 - 6:06 pm

This does not seem to work on Windows 10 when SecureBoot is enabled. If SecureBoot is enabled the digital signatures details on the .cat file generated will say “A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.” If you right click and try to install the INF file it claims there is a problem with the signature.

I was able to get it to work on a Windows 10 VMware machine where SecureBoot was not enabled. I googled the error message further and found that with SecureBoot enabled, the driver MUST be signed by Microsoft’s WHQL certification process. So in order for this to work you will have to go into your BIOS and disable Secure Boot.

Reply
admin April 15, 2019 - 11:44 am

Thanks for this info!

Reply
Marcus Ickes May 13, 2019 - 2:44 pm

This 100% absolutely Works!!! 🙂 Thank you so much. Did this for an MS 2016 Server. Old plotter drivers. Thank you, Thank you, Thank you!

Reply
Chi January 21, 2020 - 1:10 am

This worked for me on windows 10 Pro 64 bit, thanks a ton!
Just a small thing, in some places “MyDriver” and “Driver” are used interchangeably, please fix that for people who don’t get things intuitively.

Reply
admin January 28, 2020 - 6:09 am

I’ve fixed this. Thanks!

Reply
WL February 16, 2020 - 10:05 pm

It works for me on Windows 10 Pro 64bit too. Thanks a lot.

Reply
hwangjin March 27, 2020 - 11:11 am

completely fake information. installing is succeeded, but never working normally. this is possible only when testsigning is on or when old driver was already signed by another legal code certificates

Reply
bloodhand April 10, 2020 - 7:43 pm

Thanks a lot for this guide. Only using your method I could install win7 on uefi class 3: the key to forcing a custom video driver at the installation of windows was to sign it with a selfmade certificate and then add the certificate to the registry of the installation. This way the video driver will be used at first boot, being able to complete the installation while you disable standard vga to ensure full compatibility with uefi.

Reply
Wil Diel May 22, 2020 - 12:18 pm

Thanks a lot for the guide. I was able to install the unsigned driver on my windows 10 without disabling the digital signature verification.

Reply
Graham Scales June 2, 2020 - 5:54 pm

After spending a Sunday trying to do it myself on Windows 10, I came across your article. Worked brilliantly, thank you!! My Windows kit was in C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\ and as I was using Windows 10, used
Inf2Cat.exe /driver:”C:\DriverCert\xg20″ /os:10_X86,10_X64 /verbose

Reply
Chris July 6, 2020 - 1:19 am

I’ve tried three times, but it does not work. Certification process works until I do “signtool.exe verify /v /pa mydriver.cat”, then it says:

SignTool Error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Number of files successfully Verified: 0
Number of warnings: 0
Number of errors: 1

I also installed the certificate and CertMgr does say it’s valid. Until I connect my device and install my drivers, then in Device Manager the yellow “!” shows up and says that the driver can’t be trusted.

What can I do to fix this?

Reply

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange
  • Windows 10
  • Windows 8
  • Windows 7
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2008 R2
  • PowerShell
  • VMWare
  • MS Office

Recent Posts

  • How to Disable NetBIOS and LLMNR Protocols in Windows Using GPO?

    April 9, 2021
  • Enable Windows Lock Screen after Inactivity via GPO

    April 8, 2021
  • How to Create and Manage Scheduled Tasks with PowerShell?

    April 7, 2021
  • Updating Windows VM Templates on VMWare with PowerShell

    April 5, 2021
  • Running Multiple IIS Websites on the Same Port or IP Address

    April 1, 2021
  • Can’t Copy and Paste via Remote Desktop (RDP) Clipboard

    March 31, 2021
  • UAC: This App Has Been Blocked for Your Protection on Windows 10

    March 30, 2021
  • How to Unlock a File Locked by Any Process or SYSTEM?

    March 29, 2021
  • Configuring a Domain Password Policy in the Active Directory

    March 26, 2021
  • Using Native Package Manager (WinGet) on Windows 10

    March 24, 2021

Follow us

woshub.com
  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Booting Windows 7 / 10 from GPT Disk on BIOS (non-UEFI) systems
  • Removable USB Flash Drive as Local HDD in Windows 10 / 7
  • How to Create a Wi-Fi Hotspot on your Windows 10 PC
  • Error Code: 0x80070035 “The Network Path was not found” after Windows 10 Update
  • How to increase KMS current count (count is insufficient)
  • How to Configure Google Chrome Using Group Policy ADMX Templates?
  • How to Download APPX Installation File from Microsoft Store in Windows 10 / 8.1
Footer Logo

@2014 - 2018 - Windows OS Hub. All about operating systems for sysadmins


Back To Top