Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

"Drivers can be signed in one of two ways: catalog signing (which includes the signature in a catalog file) or embedded signing (which embeds the signature in the driver file)."

I was looking over a Microsoft document ( which explains that a embeded-signed driver is better than a catalog-signed driver for the Windows boot performance. I know that i must use signtool.exe to do that, the question is: how can i assign a cattagog-signed driver as embedded-signed? Is it possible? I need to get/buy new driver certificates?

share|improve this question
up vote 2 down vote accepted

A catalog file is a collection of tags, where each tag corresponds to a file installed by the driver package.

For an .inf file, the CatalogFile entry in the INF Version section of the file specifies the name of the catalog file. Changing or replacing even one byte in any of the files in the driver package, including the INF file or the catalog file itself, invalidates the digital signature.

An assembly can also be signed using a catalog file, where the security catalog is included in the manifest, embedded or not. See Creating Signed Files and Catalogs, which will direct you to Assembly Signing Example.

As regarding your question about certificates, any code-signing certificate can be used for signing in any method. Depending on your tools, the certificate may need to be in the pfx format or in spc+pvk format, but one format can be generated from the other.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .