I'm working on making a silent installer of WinpkFilter driver. In my silent installation, I'm always getting a (not so silent) prompt that says "Windows can't verify the publisher of this driver software".

Rightfully so. The cert expired in 2013 and it's cert path is just itself, which isn't a CA.

So how does the real installation do it? When I test the real installation it installs and uses the same expired cert, but there's no aforementioned Windows prompt.

How does it do that?

  • Am I right in thinking that you're building (or modifying to create) your own version of the driver? – RoraΖ Mar 4 '15 at 12:31
  • No. I'm trying to follow the real driver's installation using the same exact files, certs, and registry-entries. The end result should look exactly the same; an installed WinpkFilter driver. – bzupnick Mar 4 '15 at 12:58
  • If you're writing a wrapper around the winpkfilter driver then your wrapper would have to be signed. I'm guessing its flagging your wrapper, and not the driver itself. – RoraΖ Mar 4 '15 at 13:08
  • So the process that installs the driver itself needs to be signed....? – bzupnick Mar 4 '15 at 13:29
  • Depending on which Windows version you're installing on, and the settings... yeah. – RoraΖ Mar 4 '15 at 13:48

From what I read in the comments and in chat I think this is related to timestamping. The driver has been signed at a time the certificate was valid. That signing time was confirmed by a certified timestamp server.

In that case, the driver is considered as trustworthy, since everything was fine at the time of signing.

To check for a timestamp, open the file properties in Windows Explorer, go to "Digital signatures" and check if there is a countersignature with the timestamp. It should look like this:

Digital signatures - countersignatures

Your application (installer), however, was

  • not timestamped at all
  • or the timestamp was not provided by a trusted timestamp server
  • or the certificate itself was revoked to a time before the timestamp was created
  • or the certificate is not trusted by a CA

so that a warning UAC dialog is shown.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.