How to properly install signature for testing driver?

[thebluefish]

I have built a basic KMDF package for a USB driver. On my test machine, I installed my WDRLocalTestCert.cer to my Local Machine's Trusted Root CA. This allowed me to install my driver onto the target USB device through Device Manager, however afterwards the device fails to start with:

Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)

I cannot figure out if this is a problem with the certificate store I installed this in, or a problem with the package I'm trying to install.

[Melvin Wang (wmmc88)]

I'm assuming you are using the latest version of the repo on Main branch since the certificate is WDRLocalTestCert.cer. Could you give these install instructions a try:
https://github.com/microsoft/windows-drivers-rs/tree/main/crates/sample-kmdf-driver#install

Specifically Step 2 deals with the certificate. I see you've installed it to Local Machine's Trusted Root CA, but you also have to add it to Local Machine's Trusted Publishers

[thebluefish]

Thank you for pointing me, I installed the cert to my Local Machine's Trusted Publishers. In a desperate bid, I reinstalled it to both Current User and Local Machine's Trusted Root CA / Trusted Publishers.

I appear to get the same error as before after removing and plugging the device back in. I then uninstalled the driver, deleting local files. I scanned for device changes in device manager so it would re-appear, then attempted to update the driver to my build. This now produces the same error but on the install screen

I have also attempted to remove and reinstall the driver via:

pnputil.exe /delete-driver wincube.inf /uninstall
pnputil.exe /add-driver wincube.inf /install

And while this causes the driver to appear in the list of compatible, it does not solve the error.

[thebluefish]

I checked my certificate store on this machine and found the WDRLocalTestCert in an Intermediate CA store - I believe this is where it auto-installed on my first attempt. After removing it from this store, I was able to install the driver successfully.

However after rebooting as required, the device in Device Manager is stopped with

Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)

[thebluefish]

I had apparently only disabled "driver signature enforcement" on my test machine temporarily when first setting it up, but was enabled when I attempted to actually install the driver. Disabling that now shows a device that appears to be setup correctly.

[Melvin Wang (wmmc88)]

I believe that Driver Signature Enforcement shouldn't need to be disabled. It may be because your DUT did not enable test-signing via bcdedit /set testsigning on. More info on mslearn here: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option

You can also use signtool verify to see validate that signing is done properly and I've integrated a cargo-make tasks for it. See https://github.com/microsoft/windows-drivers-rs/blob/103ad12e34d9188b54e29fcb717fccaa746bc630/README.md#driver-package-signature-verification