2

I just gathered all the drivers in my system32/drivers folder and checked their certificate (my windows is updated and its a windows 10 x64)

But i found that so many of them have expired certificate! and some are not even signed! (pictures included)

so my questions are :

  1. Is this normal? if not, what should i do? and if so, then why are the expiration date expired?

  2. How are these drivers are able to get loaded when they have no certificate or its expired? my system is W10 x64 with secure boot enabled, i thought you can only load signed drivers with valid certificates?

  3. What is the role of these countersignatures put in simply? i tried reading MSDN and other websites but couldn't understand whats the need of this?

[EDIT 1] I also checked with process explorer, and yes so many of them are actually loaded.

here are some examples :

WindowsTrustedRTProxy.sys (countersignature is also expired, and this is loaded) :

enter image description here

acpipagr.sys (no certificate STILL LOADED) :

enter image description here

Improve this question
6
  • Are you 100% those drivers are being used. Just because they exist on your system doesn’t mean they are being used.
    – Ramhound
    Jul 12, 2020 at 14:20
  • @Ramhound yes they are being used! i checked with process explorer, WindowsTrustedRTProxy is loaded (0 detection in VT as well so no problem with the file it seems)
    – Mery Ted
    Jul 12, 2020 at 14:26
  • Yes; This is normal; The certificate used to sign the files has not actually expired. You have to look at the Certificate Path to see the correct information.
    – Ramhound
    Jul 12, 2020 at 15:03
  • @Ramhound but that doesnt make any sense? if the certificate of the file itself has expired then why would the certificate path be even relevant? so any certificate that has been expired but has other certificates in its path that are not expired, is still a valid cert?
    – Mery Ted
    Jul 12, 2020 at 15:52
  • The files were signed when they were created. If you look at the certificate path you can see that, the certificate that is currently on your system, has not expired.
    – Ramhound
    Jul 12, 2020 at 16:32

1 Answer 1

Reset to default
0
  1. Is this normal? if not, what should i do? and if so, then why are the expiration date expired?
  1. How are these drivers are able to get loaded when they have no certificate or its expired? my system is W10 x64 with secure boot enabled, i thought you can only load signed drivers with valid certificates?

As long as the certificate is valid at the signing time, it's OK. The digital signature guarantees the file is from a trusted source and not compromised, the actual time when you use that file is not relevant.

  1. What is the role of these countersignatures put in simply? i tried reading MSDN and other websites but couldn't understand whats the need of this?

I'm not quite sure about those unsigned drivers, I checked some machines installed with official Win10, they all have unsigned winusb.sys, so I guess this is common, even though might not be a good practice.

Improve this answer
7
  • There are even unsigned drivers that are loaded! check out the new picture, how can you even load a unsigned driver in x64?!
    – Mery Ted
    Jul 12, 2020 at 16:30
  • and I still don't get why the certificate itself says this certificate is valid from 2018 till 2019, yet the windows still loads it in 2020? isnt this bad practice? so even a certificate from 2010 that was expired 10 years ago can still be used?
    – Mery Ted
    Jul 12, 2020 at 16:30
  • "As long as the certificate is valid at the signing time, it's OK." How do you know the signing time? (hint hint)
    – David Balažic
    Jul 12, 2020 at 16:36
  • I don't know why Windows loads unsigned drivers, it looks quite dangerous. As for the certificate question, it means any modifications signed by this certificate during this period is trusted, so even now the certificate is outdated, the file is not modified after its last trusted modifications, the file is still good to use.
    – nullstd
    Jul 13, 2020 at 1:40
  • There's a property "Signing time" in the Signer information
    – nullstd
    Jul 13, 2020 at 1:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .