I have built my own version of the OpenVPN TAP driver (NDIS5) and have to package it with my application. From the anniversary update of Windows 10 (1607), Windows is supposed to reject the signature of kernel mode drivers NOT signed by Microsoft except in certain circumstances.

The driver is correctly signed with a new EV cert from Digicert. It's a new installation of Windows 1607, not an update. Secure Boot is on. Why is Windows accepting it?

From the Microsoft docs, I had expected to have to go through the hardware developer portal to have my driver approved by Microsoft.


  • ask it as a comment in the blog – magicandre1981 Aug 19 '16 at 4:26
  • So when was the certificate issued? – Ramhound Aug 19 '16 at 10:03
  • @Ramhound it's a brand new cert. – Avram Aug 22 '16 at 1:38

I figured it out. There's an exception for drivers signed with a Cross Signing Cert that was issued before July 29th 2015. Although my EV cert is brand new, the cross signing cert comes from the root CA cert, in our case DigiCert, which was issued in 2011.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.