Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I recently got a new EV cert from SSL.com. The cert was cheap ($269/yr) and going through validation was easy but the YubiKey token didn't work and it took days of back-and-forth with support to finally get it working. To make up for sending a defective token, they gave me a free 3 year OV cert. Besides having to put in the PIN every time I sign with the EV, it all seemed to work out. Until I just tried to submit for attestation signing.
The signature algorithm for my new cert is sha384ECDSA. Partner Center rejected my package saying:
"For a Windows 10 submission, the input package and the included files must be signed with sha256 signature algorithm."
Does Partner Center really not support sha384ECDSA certificates? SSL.com is listed on Microsoft's own website as a provider for EV certs.
Has anyone else had this issue?
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Internals & Software Drivers||19-23 June 2023||Live, Online|
|Writing WDF Drivers||10-14 July 2023||Live, Online|
|Kernel Debugging||16-20 October 2023||Live, Online|
|Developing Minifilters||13-17 November 2023||Live, Online|
I’m thinking’ you got an EV SSL cert… not an EV Code Signing cert, which is what’s required.
Just a guess.
Nope. Definitely got a EV code signing cert. Not my first rodeo so not that stupid (although maybe going with SSL.com wasn't the smartest).
And I see I'm not the only one with this problem. @Lakelands posted about the same error a few weeks back.
Maybe too soon to say that Microsoft Partner Center has a bug but the fact the files validate fine on Windows both with signtool and Explorer definitely says something is wrong somewhere.
Microsoft examined one of our submissions that failed with the subject error. Microsoft explained the reason ev certs from ssl.com do not work is submission packages must be signed with SHA2 only. When a ssl ev cert is used there is both a SHA2 and a SHA384 signature. So far ssl.com have offered no solution to this problem.
Thanks @Lakelands Makes you wonder why Microsoft lists SSL.com as a valid EV cert provider. This is definitely a Microsoft created problem but like most issues they will just ignore it. Just like cross-signing so now I have to set up a test rig for HLK/HCK for tests that won't pass for my isolation filters. I also don't understand how SSL.com can sell an EV cert that doesn't validate for the ONE THING it has to validate for. The entire code signing is so broken. Google is now requiring you provide private keys before you can publish new Android apps. Probably just a matter of time before Microsoft does something just as stupid.
Does anyone from Microsoft read these boards? Do they not realize how terrible their policies are?
Hmm ... or, SSL.com can stop issuing a SHA384 with their EV cert. You, as the paying customer, have the ability to make that happen by singing loud and strong how the SSL.com cert is useless and taking your business elsewhere. I guarantee that folks read forums like this to see what providers get it "right" and which "get it wrong" and if SSL.com sees their business drop as a result will likely stop issuing bad cert's ...
These are standards. If Windows can validate a sha384ECDSA, then Partner Center should too. Microsoft should also then not list SSL.com as a EV provider on their page of suggested providers. This is completely Microsoft issue.
Hmm ... and so here you sit, with a certificate that you can't use, telling MS that it's their problem ... in the meantime others are able to make forward progress getting stuff signed. Were I in your situation I would a) ask on the list what providers people have gotten signatures with recently and b) get one of those cert's from a provider that others are using then c) drop the SSL.com cert into the round file and get back to making forward progress ...
Does Microsoft not do due diligence on their recommended providers? Are we peasantry just supposed to play Russian roulette by wasting time and money getting verified to satisfy Microsoft's rules to only find out afterwards that the product is busted? Gimme a break. I repeat, if Partner Center can't recognize sha384ECDSA then yes it is Microsoft's problem. You think sha256 will last forever?
If you have something actually useful to add, instead of pontifications on what I should do, I'd love to hear it. Otherwise, you opinion is noted.
What Mr. @craig_howard said.
You wanted a cheap cert, you went with SSL.COM. Use Digicert like everyone else, and avoid the problem entirely.
Microsoft says SSL.COM meets their criteria. Who knows why/when SSL.COM started issuing certs with sha384ECDSA…. And I agree it should all work. And I get that it’s frustrating. But I’ve gotta say, if this is your biggest problem in driver development, you’re a lucky person.
DigiCert is going that way too...
Since it's not your first rodeo, maybe you've already ruled this out too. But since you mentioned "for my troubles, they also gave me a free three-year OV cert" in addition to the EV cert you purchased, is the outcome any different if you sign with the OV cert?
Meaning, you indeed must have an EV cert, and you have already uploaded the EV cert to your Microsoft Partner Portal account. If you also upload the OV cert to your Microsoft Partner Portal account, and then sign the submission using the OV cert instead of the EV cert, does the OV cert also have the same sha384 issue as confirmed to exist when using the SSL.com EV certificate signature?
Thanks for the suggestion. The OV is sha256 but unfortunately it did not work in any combination I tried.
Driver: EV, CAB: OV "SignatureValidationFailed"
Driver: OV, CAB: OV "SignatureValidationFailed"
Driver: OV, CAB: EV Original error that I already posted
Driver: EV, CAB: EV Original error that I already posted
The driver binaries need not be signed at all, and are not part of any validation or checking that is occurring. If a signature is already present on the binaries, the Microsoft signature will be added in addition. And since cross-signing is or soon to be deprecated, "a signature already on the binaries prior to submission" would seem to be of little or no use. And literally "gets in the way" trying to use the signed binaries on down-level platforms.
Signature of the .CAB being submitted is what's being evaluated. Since you didn't mention specifically the same error message again, "For a Windows 10 submission, the input package and the included files must be signed with sha256 signature algorithm", it makes me wonder whether the OV signature has not been uploaded to your Microsoft Partner Portal account? And that's the reason for the "SignatureValidationFailed"?
Meaning same as when you uploaded your EV signature to the Microsoft Partner Portal account by downloading and signing their "SignableFile.bin" artifact, go through those same steps again but using the OV certificate. Such that when you're done, the thumbprints of your OV certificate and your EV certificate are both listed in the Certificate Management section of your Microsoft Partner Portal account.
Maybe that's what you already did for the current test; just confirming to be sure.
The EV certificate is what's required in order to have a Microsoft Partner Portal account at all. But submissions can be signed using any certificate listed in your Microsoft Partner Portal account; not just the EV certificate. The only exception to this I'm currently aware of is LSA Plug-In signing, which requires submissions be signed with the EV certificate. Attestation, HLK/HCK, and UEFI submissions do not require being signed with the EV certificate.
Amazing! Uploading the OV and using that to sign the CAB works. I didn't even think to upload the OV because even the 'SignableFile.bin" page says it needs to be an EV.
Still feels like a busted Partner Center issue to me. Shouldn't have to buy a second cert on top of the EV to make this process work. But thanks for your help.
Hello, i have same problem. i've renew certificate on sectigo.com and now it has sha384 algorithm, microsoft also doesn't accept my submission, i have write to microsoft support, live chat and twitter and didn't received any answers.
As Peter has alluded to in other posts, the control you have over your own fate here is to try and obtain a certificate which has an sha256 signature algorithm. It can be -- but does not have to be -- your EV certificate. As it was in MDH's case in this thread, where a separate OV certificate was obtained and used for signing Microsoft Partner Portal submissions instead.
So you could talk to sectigo.com, to tell them that the Microsoft Partner Portal does not accept submissions using your new EV certificate. And see whether sectigo.com has any free or non-free solutions for you. Such as re-issuing your EV certificate (doubtful), giving you a separate OV certificate to use (maybe), or saying you'll simply need to buy a separate OV certificate with only an sha256 signature algorithm.
Yes, you should also be trying to contact Microsoft regarding the issue. And presumably, Microsoft will eventually fix this issue, whether they respond to any of your inquires or not. But presuming you have products that need to be signed now, that may not be something you can wait for.
I asked to sectigo give me OV certificate, but they said that it also has sha384 algorithm, so currently we can't sign our driver correct
Could someone please explain how to check which SHA algorithm a particular EV code certificate implements, SHA1/SHA256/SHA384?
Couldn't find any way to check this out by either signtool or Safenet tools.
Found one way to do this, through right clicking on the signed file in Windows, selecting Properties -> Digital Signatures -> Selecting the signature -> Details -> View Certificate -> Details -> Signature Algorithm.