Windows 10 : Error code 52 in device manager with correct signature in cross-signed driver

Question

我们开发了一个驱动程序，并用我们公司的Verisign签名(SHA1 + SHA256，包括证书链)对cat和sys文件进行了签名。我们在 Windows 7 和 10(32 位和 64 位版本)下对其进行了测试。现在我们有一些随机客户报告说我们的设备在设备管理器中没有被正确识别并且出现错误 52:

Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)

Setupapi.dev.log 显示此错误:

_!!! dvi: Device not started: Device has problem: 0x34 (CM_PROB_UNSIGNED_DRIVER), problem status: 0xc0000428

但是 Setupapi.dev.log 中的这条消息也存在于工作安装中。

签名工具显示签名有效，windows资源管理器的属性页也是如此。

这种行为的原因是什么？

Answer 1

可能的解决方案是 not dual signing the cat file和 checking the root certs of the customer's pcs .我还了解到 setupapi.dev.log 中的错误消息 is perfectly normal

在对大量明显相互矛盾的 Microsoft 文档进行研究后，我终于找到了 https://learn.microsoft.com/windows-hardware/drivers/install/kernel-mode-code-signing-policy--windows-vista-and-later-它说:

"Note: Starting with Windows 10, version 1607, Windows will not load any new kernel mode drivers which are not signed by the Dev Portal.

[...]

Cross-signed drivers are still permitted if any of the following are true:

The PC was upgraded from an earlier release of Windows to Windows 10, version 1607.

Secure Boot is off in the BIOS.

Drivers was signed with an end-entity certificate issued prior to July 29th 2015 that chains to a supported cross-signed CA."

事实证明，在我们的所有测试机器上都没有启用安全启动，但恰好在出现问题的客户机器上启用了安全启动。

现在我们必须对驱动程序执行 WHQL 认证。幸运的是，有些公司提供此服务，因此我们不必维护认证机器池。