self-signed NIC coinstaller prevent the nic being disabled?

NTDEV
1

Hi All,

We have a self-signed NIC miniport driver package(NDIS 5 for Windows 2003) which includes the driver, coinstaller, inf and catalog file. We are using the commercial CA certificate for the sign self, not the self-generated test certificate.

The problem is after driver and coinstaller are installed on Windows 2003, I can not disable the NIC from the control panel->network connection folder. It pops up an error “it is not possible to disable the connection at this time. This connection may be using one or more protocols that do not support Plug-and-Play, or it may have been initiated by another user or system account”.

And I found an error in the setupapi.log:
“E358 An unsigned, incorrectly signed, or Authenticode™ signed file “C:\WINDOWS\system32\nicconinst.dll” for driver “xxxx Ethernet Adapter” blocked (server install). Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
#E161 Processing of call to class installer failed. Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.”

Also there is KB on microsoft website http://support.microsoft.com/kb/318291/en-us
Basically it is by design that the NIC can not be disabled if a unsigned coninstaller is used.
You have to sign the driver to get this resolved. But it did not say what kind sign is needed for the coinstaller.

So my question is: do I have to get WHQL sign of the driver package to get rid of this issue or self-sign/test-sign should be fine and their might be some problem with my coinstaller? My coinstaller is not called during the disable. If anybody on the list have the similar experience, I would appreciate it if you could share it with me.

Thanks,
William

2

> So my question is: do I have to get WHQL sign of the driver

package to get rid of this issue or self-sign/test-sign
should be fine and their might be some problem with my
coinstaller? My coinstaller is not called during the
disable. If anybody on the list have the similar experience,
I would appreciate it if you could share it with me.

For W2K3, an Authenticode certificate will not work for a device that has a
WHQL signature class, like a NIC.

You will have to get a real WHQL signature, although an unclassified
signature will do the trick.

For testing use only (you can’t ship to customers), you can get a WHQL test
signature (no tests required) from the winqual site and install the test
root (this is not a self signature like Vista/W2K8 test signatures).

Jan

3

I got simillar experience with coisntaller on win2k3.

I tried to use test-sign facility on winqual site and they demand “cabbed
cat files” to upload. What is that exactly?
For try, I used makecab to create cab file of our cat file and uploaded, but
winqual is showing failed status.

What is unclassified signature?

Thanks,
Ashish

On Wed, Feb 25, 2009 at 7:42 AM, Jan Bottorff wrote:

> > So my question is: do I have to get WHQL sign of the driver
> > package to get rid of this issue or self-sign/test-sign
> > should be fine and their might be some problem with my
> > coinstaller? My coinstaller is not called during the
> > disable. If anybody on the list have the similar experience,
> > I would appreciate it if you could share it with me.
>
> For W2K3, an Authenticode certificate will not work for a device that has a
> WHQL signature class, like a NIC.
>
> You will have to get a real WHQL signature, although an unclassified
> signature will do the trick.
>
> For testing use only (you can’t ship to customers), you can get a WHQL test
> signature (no tests required) from the winqual site and install the test
> root (this is not a self signature like Vista/W2K8 test signatures).
>
> Jan
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
Ashish Purkar

4

Thanks Jan! Actually our certification department got WHQL test signature but the problem still exist. But I guess it is because I did not install the test root certificate (testroot.cer). I did not see it in the test sign package. Where can I get this certificate?

5

Test WHQL signing DOES work. You need to:

  1. generate a valid .cat file with like inf2cat.exe
  2. package the .cat file(s) in a .cab file with any of the .cab tools
    (cabarc, makecab)
  3. upload the .cab and wait for the winqual site to process it (NO tests
    need to be run)
  4. download and replace your unsigned .cat with the test signed one
  5. add the whql test root certificate to the correct certificate store on
    the test system (the test root file used to be really hard to find a copy
    of)
  6. reboot
  7. you can tell the test root is correctly installed by a banner showing up
    on the bottom right of the screen that says something like “for testing
    purposes only”
  8. your driver now acts just like a whql signed one, except you can’t
    legally give it to customers

Unclassified whql signatures (which can be shipped to customers) can be
given to drivers that pass the dtm unclassified tests. The unclassified
tests are significantly easier to pass than full device class tests. An
unclassified signature allows W2K3 to technically function with a whql
signed driver (i.e. server side silent install works for all device classes)
but you can’t claim to be whql certified in any marketing, and I don’t
believe it qualifies for OS support (MSFT will not give support guarantees
for systems running non-WHQL certified drivers). I thought you can’t put an
unclassified signed driver on Windows update, although someone here though
that was not true. The process is just like normal WHQL certification,
except you select the unclassified device class in dtm. I assume the costs
are also the same for unclassified signatures. Last I knew, ANY device class
can be signed in the unclassified category, even if it normally would fit in
a more stringently tested device class.

Vista/W2K8 are more flexible about driver signing, and you can use a self
signed certificate if you install it and tell the OS to give equal weight to
non-WHQL signatures.

I’ve only worked on server OS’s for a while, so am not sure what XP signing
requirements are. I believe a little less stringent than W2K3, but not as
flexible as Vista/W2K8. There used to be an obscure Microsoft document that
spelled out in explicit detail what each OS version’s driver signing
policies were.

Jan

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ashish Purkar
Sent: Tuesday, February 24, 2009 10:57 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] self-signed NIC coinstaller prevent the nic being
disabled?

I got simillar experience with coisntaller on win2k3.

I tried to use test-sign facility on winqual site and they demand “cabbed
cat files” to upload. What is that exactly?
For try, I used makecab to create cab file of our cat file and uploaded, but
winqual is showing failed status.

What is unclassified signature?

Thanks,
Ashish

On Wed, Feb 25, 2009 at 7:42 AM, Jan Bottorff wrote:

> So my question is: do I have to get WHQL sign of the driver
> package to get rid of this issue or self-sign/test-sign
> should be fine and their might be some problem with my
> coinstaller? My coinstaller is not called during the
> disable. If anybody on the list have the similar experience,
> I would appreciate it if you could share it with me.

For W2K3, an Authenticode certificate will not work for a device that has a
WHQL signature class, like a NIC.

You will have to get a real WHQL signature, although an unclassified
signature will do the trick.

For testing use only (you can’t ship to customers), you can get a WHQL test
signature (no tests required) from the winqual site and install the test
root (this is not a self signature like Vista/W2K8 test signatures).

Jan

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

–
Ashish Purkar

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

The test root certificate is HARD to find. A year or so ago I searched for
weeks. I found if you installed a piece of beta MSFT software (I used beta
Virtual Server at the time) it will be in the root certificate store, and
you can export it. You can tell it’s installed if you get the “for testing
only” banner on the bottom right of the screen. The test root might
currently be part of the IE 8 beta.

Microsoft REALLY needs to make the test root certificate easily available on
the winqual site, if they haven’t fixed this. It not being there is one of
those kinds of issues, that should be fixable by them in 10 minutes, and
causes multiple driver developers hours of head scratching. If it’s not on
winqual, I suggest you open a support ticket and say it’s a WDK bug.

Is there anybody from the WDK team or winqual team reading these messages
who could assure the test root certificate is easy to find? EVERYBODY who
makes whql signed drivers (which is almost all driver developers) needs it.
Like maybe change the winqual test signing script so it always includes a
copy in the test signed .cab file. A quick search of the winqual help
section on test signing I just did didn’t offhand have any clues to where
one would download the test root. A download link on like
https://winqual.microsoft.com/help/How_to_Use_Test_Signatures.htm would help
a LOT.

I’d hate for ANOTHER driver developer to waste time hunting for the test
root.

Jan

Thanks Jan! Actually our certification department got WHQL
test signature but the problem still exist. But I guess it is
because I did not install the test root certificate
(testroot.cer). I did not see it in the test sign package.
Where can I get this certificate?

7

Thank you very much Jan for the detail explanation. I totally agree with you that Microsoft should make the test root easily available driver developer. I’ll try to see if the DTM test client machine have the cert installed or not. Thanks again.

8

I found the test root is installed on my dtm test client machine. I test the Microsft test sign driver on that machine and I can disable/enable the nic now. Thanks Jan!