# How to Sign Windows Drivers & Executables

## Overview

![](https://cdn-learn.adafruit.com/assets/assets/000/031/242/medium800/manufacturing_signed.png?1457988984)

You've got a hot new product, ready to sell - You're a pro now! But part of that professionalism is making sure you have signed versions of all your drivers. If you're using a FTDI or Cypress or SiLabs chip to do USB, you might already have a signed driver that comes with it.

If not, its an extra step and expense that will make your life (and your customer's lives!) much easier. These are my notes as I signed a Circuit Playground CDC driver file, made an installer, then signed that installer

#  More details!

Big ups to Pololu-pal David Grayson's intensely detailed tutorial which taught me everything I know! :)

[http://www.davidegrayson.com/signing/#howto](http://www.davidegrayson.com/signing/#howto)

Really, read the above if you need more than these steps, or read both tutorials at once for stereo-vision learning

# How to Sign Windows Drivers & Executables

## Installing Windows SDK

Visit Microsoft's SDK download page to grab the latest standalone SDK. Even though this is the Windows 10 SDK, you can install it on Windows 7 if you need to.

[https://dev.windows.com/en-us/downloads/windows-10-sdk](https://dev.windows.com/en-us/downloads/windows-10-sdk)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/220/medium800/manufacturing_winsdk10.png?1457985014)

Its ok to install in **C:\Program Files(x86)\Windows Kits\10\**

![](https://cdn-learn.adafruit.com/assets/assets/000/050/686/medium800/manufacturing_sdk1.png?1517768237)

The screenshot below shows the minimal set of features you need to install to do signing: **Windows IP over USB** (required by SDK for UWP), **Windows SDK Signing Tools for Desktop Apps** (installs `signtool.exe`), and **Windows SDK for UWP Managed Apps** (installs `certmgr.exe`). You can install more if you're doing Windows development.

![](https://cdn-learn.adafruit.com/assets/assets/000/050/694/medium800/manufacturing_sdkneeded.png?1517775060)

Done!

![](https://cdn-learn.adafruit.com/assets/assets/000/050/688/medium800/manufacturing_sdk3.png?1517768510)

You can now find `signtool.exe `and `certmgr.exe` in `C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64` (or a newer version, if one has been released). Previous SDK installations did not include a version number in the path.

![](https://cdn-learn.adafruit.com/assets/assets/000/031/224/medium800/manufacturing_signtool.png?1457986282)

### Download Windows WDK (Windows Driver Kit)

Go to [https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk](https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk) and download the latest WDK (not ADK, scroll down!). You don't need to install Visual Studio first even though it looks like a prerequisite. Install into the same location:

![](https://cdn-learn.adafruit.com/assets/assets/000/050/691/medium800/manufacturing_wdkstart.png?1517770467)

This warning is OK.

![](https://cdn-learn.adafruit.com/assets/assets/000/050/692/medium800/manufacturing_wdkwarn.png?1517770555)

![](https://cdn-learn.adafruit.com/assets/assets/000/050/689/medium800/manufacturing_wdk2.png?1517769267)

Half an hour later...WDK is installed!

![](https://cdn-learn.adafruit.com/assets/assets/000/050/690/medium800/manufacturing_wdkdone.png?1517769832)

Now you can check `C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86`  (or whatever version you installed) to see that you have a new tool called `inf2cat.exe`.

![](https://cdn-learn.adafruit.com/assets/assets/000/050/693/medium800/manufacturing_wdkinf2cat.png?1517771266)

# How to Sign Windows Drivers & Executables

## Buy & Download Certificate

In order to sign a driver you need a **Code Signing Certificate** - once purchased you can use it for a period of time to sign as much code/drivers as you like. For example, a 3 year certificate can be used for 3 years to sign drivers as needed. After 3 years, all your signed drivers still work great but you will have to buy a new cert if you have code you would like to sign a-new

# Buy Code Signing Certificate

We bought our cert from **GlobalSign**

![](https://cdn-learn.adafruit.com/assets/assets/000/031/194/medium800/manufacturing_globalsign.png?1457972567)

Make an account, it will have a strange usrename that starts with PAR

![](https://cdn-learn.adafruit.com/assets/assets/000/031/196/medium800/manufacturing_login.png?1457972715)

You can click on **Order Certificates** - we already did so we have a certificate we paid for a few years ago, certificates cost ~$500

![](https://cdn-learn.adafruit.com/assets/assets/000/031/198/medium800/manufacturing_codesign.png?1457972794)

To **re-download** your certificate you'll have to click **EDIT** to the left of the Order ID. Which is so counter-intuitive but basically you are _re-issuing_ the cert.

![](https://cdn-learn.adafruit.com/assets/assets/000/031/199/medium800/manufacturing_certid.png?1457972807)

Continue through and pick a secure Pickup Password, this password is only used to download the certificate, it isnt the password for the cert itself!

![](https://cdn-learn.adafruit.com/assets/assets/000/031/200/medium800/manufacturing_pickup.png?1457972875)

Pick a hash algorithm. For backwards compatibility with XP SP2 you can request SHA-1 but these days you should probably just go with SHA-256 since it is more secure

![](https://cdn-learn.adafruit.com/assets/assets/000/031/201/medium800/manufacturing_sha256.png?1457972925)

Click **Next**...this will have the pickup email sent to the email address associated with the account.

![](https://cdn-learn.adafruit.com/assets/assets/000/031/202/medium800/manufacturing_certapp.png?1457972976)

Check your email, you'll have the pickup link in there. Click it!

![](https://cdn-learn.adafruit.com/assets/assets/000/031/203/medium800/manufacturing_pickupemail.png?1457973017)

You'll be asked for that password from before. If by chance you forgot it in the last 5 minutes, you'll need to start over.

![](https://cdn-learn.adafruit.com/assets/assets/000/031/204/medium800/manufacturing_pickuppass.png?1457973054)

You'll now be asked to be a private key for the certificate. You'll need this to install the certificate. **Keep this secret from getting out or someone could be able to sign malware with your name, no good eh?!**

![](https://cdn-learn.adafruit.com/assets/assets/000/031/205/medium800/manufacturing_installcertpass.png?1457973142)

OK finally - download the certificate file!

![](https://cdn-learn.adafruit.com/assets/assets/000/031/206/medium800/manufacturing_download.png?1457973221)

# Install Certificate

OK how that you have the **pfx ** file, right click on it and **Install** it!

![](https://cdn-learn.adafruit.com/assets/assets/000/031/207/medium800/manufacturing_installpfx.png?1457973279)

Go through the wizard to install the cert...

Make sure the right file is selected:

![](https://cdn-learn.adafruit.com/assets/assets/000/031/209/medium800/manufacturing_wiz2.png?1457973329)

To install, you'll need to enter in that long private key you put in doing the pickup process. I recommend marking the key as exportable, so you don't have to go thru the pickup process if another person needs to install it and you lost the certificate file.

![](https://cdn-learn.adafruit.com/assets/assets/000/031/210/medium800/manufacturing_wiz3.png?1457973358)

You can use the Automatic Store to put it in your cert manager

![](https://cdn-learn.adafruit.com/assets/assets/000/031/211/medium800/manufacturing_wiz4.png?1457973441)

And, Finish!

![](https://cdn-learn.adafruit.com/assets/assets/000/031/212/medium800/manufacturing_wiz5.png?1457973456)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/213/medium800/manufacturing_wiz6.png?1457973462)

# Checking Installed Cert

Now that you have the certificate, its easy to check it out in your Cert Manager.  Visit `C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86` and run **certmgr.exe**

![](https://cdn-learn.adafruit.com/assets/assets/000/031/232/medium800/manufacturing_certmgr.png?1457987298)

In **Personal** , you'll be able to see your signing cert!

![](https://cdn-learn.adafruit.com/assets/assets/000/031/215/medium800/manufacturing_certmgr2.png?1457973541)

You can click on **Advanced** to get more details about the cert:

![](https://cdn-learn.adafruit.com/assets/assets/000/031/216/medium800/manufacturing_certpath.png?1457973565)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/217/medium800/manufacturing_details.png?1457973607)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/218/medium800/manufacturing_gendetails.png?1457973638)

# Download Intermediate Certificate

Finally, you need the matching root certificate file from GlobalSign. [Go here to download it, you'll need to cross-lookup the right cert](https://support.globalsign.com/customer/portal/articles/1426602-globalsign-root-certificates), for SHA-256 its Root-R3.crt

![](https://cdn-learn.adafruit.com/assets/assets/000/031/276/medium800/manufacturing_rootcerts.png?1458013668)

Save the root certificate to your Desktop, you'll need it in the next step

![](https://cdn-learn.adafruit.com/assets/assets/000/031/277/medium800/manufacturing_r3.png?1458013729)

# How to Sign Windows Drivers & Executables

## Signing Driver

We'll be signing a serial port inf driver file. Basically this just tells Windows "Hey use the CDC Serial driver you have already" but lets it know the name, VID and PID for the device.

![](https://cdn-learn.adafruit.com/assets/assets/000/031/236/medium800/manufacturing_inf.png?1457987601)

You can use our generic INF file, just be sure to edit it to change the VID/PID and identifier strings!

[Adafruit_Circuit_Playground.inf](https://learn.adafruit.com/system/assets/assets/000/031/234/original/Adafruit_Circuit_Playground.inf?1457987568)
![](https://cdn-learn.adafruit.com/assets/assets/000/031/235/medium800/manufacturing_editinf.png?1457987578)

 **I recommend having the name of the inf not have space in it,** just during the signing process

**Also, put the inf into a folder on your desktop, also without spaces in it**.

Only perform these steps on one inf at a time, in a single folder. srsly.

For example, I put AdafruitCircuitPlayground.inf into **C:\User\ladyada\Desktop\CircuitPlayDriver**

# Inf2Cat

To start you'll need to create a **catalog** file for the inf. You will use inf2cat for this

Run this command _in the directory with the inf file_

E.g. if the driver inf is in **C:\Users\ladyada\Desktop\CircuitPlayDriver** , open up a command line and **cd C:\Users\ladyada\Desktop\CircuitPlayDriver**

`"C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86\inf2cat" /v /os:XP_X86,Vista_X86,Vista_X64,7_X86,7_X64,8_X86,8_X64,6_3_X86,6_3_X64,10_X86,10_X64 /driver:.`

(The screenshot below is slightly obsolete: it doesn't have the version number in the path.)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/278/medium800/manufacturing_cat2inf.png?1458013835)

# Add the Root Certificate

Copy that root certificate you downloaded at the end of the last step into the same directory

![](https://cdn-learn.adafruit.com/assets/assets/000/031/279/medium800/manufacturing_certready.png?1458013916)

# Signing!

OMG are you ready??? It's finally time to sign the driver!

Open up a new command line and go to the directory **with the inf & cat in it**

`"C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86\signtool" sign /v /n "Your company name" /ac "Root-R3.crt" /tr http://timestamp.globalsign.com/?signature=sha2 /td sha256 *.cat`  
  
Of course, change Your Company Name to the certificate name's owner, and the intermediate certificate name if necessary.

(The screenshot below is slightly obsolete.)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/280/medium800/manufacturing_signed.png?1458014009)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/240/medium800/manufacturing_seccat.png?1457988474)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/239/medium800/manufacturing_digisig.png?1457988457)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/241/medium800/manufacturing_advanced.png?1457988478)

Now if the driver gets installed, the user will see the following, a happy installer!

![](https://cdn-learn.adafruit.com/assets/assets/000/031/281/medium800/manufacturing_trusted.png?1458014054)

# How to Sign Windows Drivers & Executables

## Making an Installer

OK now you have a nice signed driver, so lets make a fancy installer so people can just double-click to install

These instructions are pretty much the same as the great tutorial at:

[blog.codebender.cc/2016/01/04/create-a-simple-windows-driver-installer-using-nsis/](blog.codebender.cc/2016/01/04/create-a-simple-windows-driver-installer-using-nsis/)

# Install NSIS

[Start off by installing NSIS](http://nsis.sourceforge.net/Download) - written by[Nullsoft, the creators of WinAmp (which really whip's the llama's ass)](https://en.wikipedia.org/wiki/Nullsoft)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/243/medium800/manufacturing_nullsoft.png?1457989359)

I installed 3.0b3, the latest version as of this tutorial's writing

![](https://cdn-learn.adafruit.com/assets/assets/000/031/244/medium800/manufacturing_wiz1.png?1457989504)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/245/medium800/manufacturing_wiz2.png?1457989527)

# Find DPinst

This is the Microsoft driver installation software which came with the WDK you installed earlier.

Go to `C:\Program Files (x86)\Windows Kits\10\Redist\DIFx` and you can find many versions.

I recommend grabbing

`C:\Program Files (x86)\Windows Kits\10\Redist\DIFx\dpinst\MultiLin\x64\dpinst.exe`

and putting it in your driver folder, called **dpinst-x64.exe**

Also grab

`C:\Program Files (x86)\Windows Kits\10\Redist\DIFx\dpinst\MultiLin\x86\dpinst.exe`

and put that also in your driver folder, called **dpinst-x86.exe**

 

![](https://cdn-learn.adafruit.com/assets/assets/000/031/247/medium800/manufacturing_dpinst.png?1457990223)

# Create a configuration file!
You can spend a ton of time making super customized installation programs - ours originally was for installing a wide range of drivers, here's the core of it

```auto
# Adafruit Board Driver NSIS Install Script
# Author: Tony DiCola

# Import some useful functions.
!include WinVer.nsh   # Windows version detection.
!include x64.nsh      # X86/X64 version detection.

# Set attributes that describe the installer.
Icon "Assets\adafruit.ico"
Caption "Adafruit Board Drivers"
Name "Adafruit board drivers"
Outfile "adafruit_cplay.exe"
ManifestSupportedOS "all"
SpaceTexts "none"

# Install driver files to a temporary location (then dpinst will handle the real install).
InstallDir "$TEMP\adafruit_cplay"

# Set properties on the installer exe that will be generated.
VIAddVersionKey /LANG=1033 "ProductName" "Adafruit Circuit Playground Driver"
VIAddVersionKey /LANG=1033 "CompanyName" "Adafruit Industries"
VIAddVersionKey /LANG=1033 "LegalCopyright" "Adafruit Industries"
VIAddVersionKey /LANG=1033 "FileDescription" "Installer for Adafruit Circuit Playground board driver."
VIAddVersionKey /LANG=1033 "FileVersion" "1.0.0"
VIProductVersion "1.0.0.0"
VIFileVersion "1.0.0.0"

# Define variables used in sections.
Var dpinst   # Will hold the path and name of dpinst being used (x86 or x64).

# Components page allows user to pick the drivers to install.
PageEx components
  ComponentText "Check the board drivers below that you would like to install.  Click install to start the installation." \
    "" "Select board drivers to install:"
PageExEnd

# Instfiles page does the actual installation.
Page instfiles


# Sections define the components (drivers) that can be installed.
# The section name is displayed in the component select screen and if selected
# the code in the section will be executed during the install.
# Note that /o before the name makes the section optional and not selected by default.

# This first section is hidden and always selected so it runs first and bootstraps
# the install by copying all the files and dpinst to the temp folder location.
Section
  # Copy all the drivers and dpinst exes to the temp location.
  SetOutPath $INSTDIR
  File /r "Drivers"
  File "dpinst-x64.exe"
  File "dpinst-x86.exe"
  # Set dpinst variable based on the current OS type (x86/x64).
  ${If} ${RunningX64}
    StrCpy $dpinst "$INSTDIR\dpinst-x64.exe"
  ${Else}
    StrCpy $dpinst "$INSTDIR\dpinst-x86.exe"
  ${EndIf}
SectionEnd

Section "Circuit Playground"
  # Use dpisnt to install the driver.
  # Note the following options are specified:
  #  /sw = silent mode, hide the installer but not OS prompts (critical!)
  #  /path = path to directory with driver data
  ExecWait '"$dpinst" /sw /path "$INSTDIR\Drivers\Adafruit_CircuitPlayground"'
SectionEnd
```

Place this file in the directory with **dpinst-x86** and **dpinst-x64**

![](https://cdn-learn.adafruit.com/assets/assets/000/031/248/medium800/manufacturing_driverfolder.png?1457990944)

In Assets, put an ico file with your logo

![](https://cdn-learn.adafruit.com/assets/assets/000/031/249/medium800/manufacturing_Assets.png?1457990978)

Inside **Drivers** put another folder that contains the actual driver files. E.g. **Drivers/CircuitPlayground/circuitplay.inf** this way you can expand the installer to install more software & drivers easily

![](https://cdn-learn.adafruit.com/assets/assets/000/031/250/medium800/manufacturing_driversubfolder.png?1457991032)

If you'd like you can check out our package for the structure:

[CircuitPlayDriver.zip](https://learn.adafruit.com/system/assets/assets/000/031/255/original/CircuitPlayDriver.zip?1457991201)
Go back to the **NSI** file, right click and **Compile** it

![](https://cdn-learn.adafruit.com/assets/assets/000/031/246/medium800/manufacturing_compilensis.png?1457989759)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/251/medium800/manufacturing_compiled.png?1457991060)

Read thru the text to make sure everything was found properly!

You can now test it out - double click to run the installer

![](https://cdn-learn.adafruit.com/assets/assets/000/031/252/medium800/manufacturing_selection.png?1457991116)

![](https://cdn-learn.adafruit.com/assets/assets/000/031/253/medium800/manufacturing_completed.png?1457991140)

Check the **Details** again, to verify the installer did what its supposed to do

![](https://cdn-learn.adafruit.com/assets/assets/000/031/254/medium800/manufacturing_details.png?1457991149)

# Sign the Installer

OK since you have everything set up its easy to also sign the installer! Go into the directory where you have the generated exe and run

`"C:\Program Files (x86)\Windows Kits\10\bin\x86\signtool" sign /v /n "Company Name" /tr http://timestamp.globalsign.com/?signature=sha2 /td sha256 driverinstaller.exe`

![](https://cdn-learn.adafruit.com/assets/assets/000/031/272/medium800/manufacturing_signexe.png?1457995370)

When the customer double clicks, it will let them know that this is Verified to be from Adafruit Industries!

![](https://cdn-learn.adafruit.com/assets/assets/000/031/275/medium800/manufacturing_signedexe.png?1458000077)

You can see information about the certificate if you Show Details:

![](https://cdn-learn.adafruit.com/assets/assets/000/031/274/medium800/manufacturing_appcert.png?1458000067)

You can also check the exe properties:

![](https://cdn-learn.adafruit.com/assets/assets/000/031/273/medium800/manufacturing_signedexe.png?1457995393)


## Related Guides

- [All About Laser Cutters](https://learn.adafruit.com/all-about-laser-cutters.md)
- [Laser-Cut Enclosure Design](https://learn.adafruit.com/laser-cut-enclosure-design.md)
- [DIY 3D Printing Filament](https://learn.adafruit.com/diy-3d-printing-filament.md)
- [SMT Manufacturing](https://learn.adafruit.com/smt-manufacturing.md)
- [Standalone AVR Chip Programmer](https://learn.adafruit.com/standalone-avr-chip-programmer.md)
- [KTOWN's Ultimate Creating Parts in Eagle Tutorial](https://learn.adafruit.com/ktowns-ultimate-creating-parts-in-eagle-tutorial.md)
- [Make your own PCB with Eagle, OSH Park, and Adafruit!](https://learn.adafruit.com/making-pcbs-with-oshpark-and-eagle.md)
- [Shop Tips & Tricks](https://learn.adafruit.com/shop-tips-and-tricks.md)
- [How to convert Eagle PCBs to 3D Models in Fusion 360](https://learn.adafruit.com/how-to-convert-eagle-pcbs-to-3d-models-in-fusion-360.md)
- [Maker Business & Manufacturing Software - Our Tips & Tricks](https://learn.adafruit.com/maker-business-manufacturing-software-our-tips-and-tricks.md)
- [Creating Accurate Footprints in Eagle](https://learn.adafruit.com/creating-accurate-footprints-in-eagle.md)
- [How to Make a Pogo Pin Test Jig](https://learn.adafruit.com/how-to-make-a-pogo-pin-test-jig.md)
- [How we designed an injection-molded case](https://learn.adafruit.com/how-we-designed-an-injection-molded-case-for-raspberry-pi.md)
- [Adafruit Pinguin for EAGLE CAD](https://learn.adafruit.com/adafruit-pinguin-for-eagle-cad.md)
- [Metal Parts from 3D Prints](https://learn.adafruit.com/metal-parts-from-3d-prints.md)