Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The 64-bit Windows 7 image that we deploy to machines at our site does not contain all of the certificates included on a default Windows image. Automatic root certificate installation is also disabled per policy from higher in the organization. We have had a lot of trouble installing many WHQL-certified drivers from reputable companies (ex. HP, Lexmark, Dell, etc.), and I hypothesize that a required certificate is missing from one of the certificate stores on the machine. The error we typically get is:

The driver cannot be installed because it is either not digitally signed or not signed in the appropriate manner.

I know that it is signed. A .CAT file is included, and it has the following tree from top to bottom:

  • Microsoft Root Authority (thumbprint a4 34 89 15 9a 52 0f 0d 93 d0 32 cc af 37 e7 fe 20 a8 b4 19)
    • Microsoft Windows Hardware Compatibility PCA (thumbprint 93 b8 d8 82 0a 32 db 20 a5 ea b6 8d 86 ad 67 8e fa 14 ea 41)
      • Microsoft Windows Hardware Compatibility Publisher (thumprint b0 50 45 45 42 4e be 2c 16 2f 62 5b bf 5a e6 9b 96 bf 0b 0b)

What certificates are required to install WHQL-certified drivers? Is it possibly something other than certificates?


NOTE: I have posted this question on Technet as well, but honestly, I've never had a lot of luck posting questions on the Technet forums.

share|improve this question
up vote 2 down vote accepted

At execution time, none. Kernel Mode Code Signing doesn't use the normal system certificate system but instead uses special cross-certificates which are bundled with the driver. There is only one root CA needed, and it's built into the system.

In Windows, cross-certificates: Allow the operating system kernel to have a single trusted Microsoft root authority.

Check the .cab file that comes with the driver. Right-click on it and hit Properties. See what that file is signed with as that's checked at installation time.

share|improve this answer
Okay, that's great information to have. I guess I'll have to fiddle with it some more to figure out why it isn't working. Thanks! – Kasius Aug 29 '12 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .