Changes between Version 66 and Version 67 of BuildingOnWindows

Timestamp:

03/16/11 12:53:08 (13 years ago)

Author:

Samuli Seppänen

Comment:

--

BuildingOnWindows

@@ -221 +221 @@
 = TAP-driver signing =
 
-The 64-bit versions of Windows Vista/7 (and later) only allow installing drivers with certificates that have Microsoft as CA. Or, in other words, drivers verified by Microsoft. Installation of unsigned nor unauthorized device drivers is not allowed by default. This is very problematic when testing the TAP-driver, as signing it after every small change makes no sense. Fortunately it ''is'' possible to self-sign the TAP-driver and configure Windows to accept self-signed (unauthorized) drivers. As the steps involved are not trivial, they are described here.
-
-
-
+The 64-bit versions of Windows Vista/7 (and later) only allow installing drivers with certificates that have Microsoft as CA. Or, in other words, drivers verified by Microsoft. Installation of unsigned nor unauthorized device drivers is not allowed by default. This is very problematic when testing the TAP-driver, as signing it after every small change makes no sense. Fortunately it ''is'' possible to self-sign the TAP-driver and configure Windows to accept self-signed (unauthorized) drivers. Several steps are required to make self-signed certificates work, all of which are described here.
+
+== Creating a test certificate ==
+
+Creating a test certificate (and it's keystore) is easy if Visual Studio is is installed. Open the Visual Studio command-line and issue
+
+{{{
+Makecert -r -pe -ss SubjectCertStoreName -n “CN=CertName” OutputFile.cer
+}}}
+
+For details on the syntax see [http://msdn.microsoft.com/en-us/library/bfsktky3(v=vs.80).aspx Makecert.exe reference]; for more details look into [http://msdn.microsoft.com/en-us/windows/hardware/gg487332 this] excellent document.
+
+== Enabling test mode on target computer ==
+
+Windows "Test mode" can be switched on using the [http://www.ngohq.com/home.php?page=dseo Driver Signature Enforcement Overrider] tool. There are other alternatives, but these require more manual steps.
+
+== Installing test certificate to target computer ==
+
+Signing the driver (or EXE) is not enough: the target computer needs to trust the certificate. This is done by importing the certificate to Window's trusted keystore using [http://msdn.microsoft.com/en-us/library/e78byta0%28v=vs.80%29.aspx Certmgr.exe]. Unfortunately to get this tool you need to install the massive [http://www.google.fi/#hl=it&xhr=t&q=Microsoft+Windows+SDK+for+Windows+7+and+.NET+Framework+3.5+SP1&cp=62&pf=p&sclient=psy&site=&source=hp&aq=0&aqi=&aql=&oq=Microsoft+Windows+SDK+for+Windows+7+and+.NET+Framework+3.5+SP1&pbx=1&fp=f4ed5df9bfb5cc9f Microsoft Windows SDK for Windows 7 and .NET Framework 3.5 SP1] package. Once ''makecert.exe'' is installed, though, using it is straightforward:
+
+{{{
+certmgr.exe -add OutputFile.cer -s -r localMachine root
+certmgr.exe -add OutputFile.cer -s -r localMachine trustedpublisher
+}}}
+
+For details look [http://msdn.microsoft.com/en-us/windows/hardware/gg487332 here].
 
 = Troubleshooting =