"Drivers can be signed in one of two ways: catalog signing (which includes the signature in a catalog file) or embedded signing (which embeds the signature in the driver file)."

I was looking over a Microsoft document (http://msdn.microsoft.com/en-us/windows/hardware/gg463386) which explains that a embeded-signed driver is better than a catalog-signed driver for the Windows boot performance. I know that i must use signtool.exe to do that, the question is: how can i assign a cattagog-signed driver as embedded-signed? Is it possible? I need to get/buy new driver certificates?


A catalog file is a collection of tags, where each tag corresponds to a file installed by the driver package.

For an .inf file, the CatalogFile entry in the INF Version section of the file specifies the name of the catalog file. Changing or replacing even one byte in any of the files in the driver package, including the INF file or the catalog file itself, invalidates the digital signature.

An assembly can also be signed using a catalog file, where the security catalog is included in the manifest, embedded or not. See Creating Signed Files and Catalogs, which will direct you to Assembly Signing Example.

As regarding your question about certificates, any code-signing certificate can be used for signing in any method. Depending on your tools, the certificate may need to be in the pfx format or in spc+pvk format, but one format can be generated from the other.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.