windows - 如果自签名 CA 根证书导入到机器商店，我可以在没有测试模式的 64 位 Windows 上安装自签名驱动程序吗？

Question

这是一个很好的 SO 答案，它涵盖了自签名 CA 的创建，然后使用获得的证书对可执行文件进行签名:How do I create a self-signed certificate for code signing on Windows? .

我在网上阅读了很多关于驱动程序签名如何工作的讨论，答案似乎几乎是明确的，即在未启用测试模式的情况下无法加载未签名或自签名的驱动程序。但是，我链接到的答案，尤其是 Roger Lipscombe 的一条评论似乎提供了一个矛盾的观点:

If you want to use this for signing drivers, you need to import the CA certificate into the machine store. My example imports it into the user store, which is fine for most software, for test/internal purposes.

对我来说，只要将 CA 证书导入机器商店，我似乎就可以安装带有自签名证书(由自签名 CA 颁发)的驱动程序。我不必对系统进行任何其他更改(通过在启动菜单上按 F8 禁用测试模式，弄乱启动配置标志，例如 TESTSIGNING 或 NOINTEGRITYCHECKS)。

我说的对吗？当人们需要加载没有提供适当数字签名的驱动程序(例如旧的打印机驱动程序等)时，这种方法没有得到更广泛使用的障碍是什么(如果有的话)。相反，人们依靠引导至测试模式或篡改系统文件的第三方软件 (DSEO) 来运行此类驱动程序。

这种方法有什么缺点？上述 SO 问题中描述的过程需要管理员权限，但无论如何安装驱动程序都需要它们。信任自签名 CA 可能存在安全风险 - 但禁用所有签名检查不会带来更大的安全风险吗？

Answer 1

不，不幸的是，这是不可能的，从 Windows Vista 和 Windows Server 2008 开始。

驱动程序必须交叉签名。创建您自己的 CA 并将其添加到计算机存储是不够的，因为新创建的 CA 不会受到 Windows 信任链的信任。

Driver Signing Requirements for Windows

In Windows Vista and Windows Server 2008, new features take advantage of code-signing technologies, and new requirements for security in the operating system enforce the use of digital signatures for some kinds of code.

Components must be signed by a certificate that Windows "trusts" as described in the white papers on this site.

其中一份白皮书是 Digital Signatures for Kernel Modules on Windows它描述了加载过程并解释了为什么自签名是不够的:

When a driver is loaded into kernel memory, Windows Vista verifies the digital signature of the driver image file. Depending on the type of driver, this can be either the signed hash value in the catalog file or an embedded signature in the image file itself. The cross-certificates that are used when signing the kernel driver package are used for the load-time signature verification; each certificate in the path is checked up to a trusted root in the kernel. The load-time signature check does not have access to the Trusted Root Certificate Authorities certificate store. Instead, it must depend on the root authorities that are built into the Windows Vista kernel.

如前所述，Requirements for Device Driver Signing and Staging 中也对此进行了概述。页:

The 64-bit versions of Windows 7 and Windows Server 2008 R2 have special signature requirements for kernel mode device drivers. If you use a 64-bit version of Windows, then you cannot create your own certificate for signing. Instead, you must use a Software Publishing Certificate that chains to an approved certification authority (CA).

可在以下页面找到用于签署内核模式驱动程序的有效 CA:

Cross-Certificates for Kernel Mode Code Signing