如果将自签名的CA根证书导入机器商店,可以在64位Windows上安装自

发布时间：2020-12-13 21:05:49 所属栏目：Windows 来源：网络整理

导读：这是一个伟大的SO答案，涵盖创建自签名CA，然后签署可执行文件获得的证书： How do I create a self-signed certificate for code signing on Windows?。我已经在线阅读了很多有关驱动程序签名工作的讨论，并且答案似乎几乎是明确的，您不能加载无符号或自

这是一个伟大的SO答案，涵盖创建自签名CA，然后签署可执行文件获得的证书： How do I create a self-signed certificate for code signing on Windows?。

我已经在线阅读了很多有关驱动程序签名工作的讨论，并且答案似乎几乎是明确的，您不能加载无符号或自签名驱动程序，而不启用测试模式。然而，我所链接的答案，特别是Roger Lipscombe的一个评论似乎提出了一个矛盾的观点：

If you want to use this for signing drivers,you need to import the CA
certificate into the machine store. My example imports it into the
user store,which is fine for most software,for test/internal
purposes.

对我来说，只要将CA证书导入到机器存储区，我可以安装具有自签名证书的驱动程序(由自签名CA颁发)。我不必对系统进行任何其他更改(通过在启动菜单上按F8禁用测试模式，弄乱启动配置标志，如TESTSIGNING或NOINTEGRITYCHECKS)。

我对么？当人们需要加载没有提供适当的数字签名的驱动程序(如旧的打印机驱动程序等)时，如果有的话，这种方法没有被广泛使用的障碍是什么。相反，人们依靠启动测试模式或第三方软件(DSEO)来篡改您的系统文件来运行此类驱动程序。

这种方法的缺点是什么？上述SO问题中描述的过程需要管理员权限，但是安装驱动程序也需要它们。信任自签名CA可能是一个安全风险 – 但不会禁用所有签名检查更大的安全风险？

不，不幸的是，从Windows Vista和Windows Server 2008开始，这是不可能的。

司机必须交叉签字。创建自己的CA并将其添加到机器存储将不够，因为新创建的CA将不被Windows信任链信任。

Driver Signing Requirements for Windows

In Windows Vista and Windows Server 2008,new features take advantage of code-signing technologies,and new requirements for security in the operating system enforce the use of digital signatures for some kinds of code.

Components must be signed by a certificate that Windows “trusts” as described in the white papers on this site.

提到的白皮书之一是Digital Signatures for Kernel Modules on Windows
，描述了加载过程，并解释了为什么自签名不足够：

When a driver is loaded into kernel memory,Windows Vista verifies the digital signature of the driver image file. Depending on the type of driver,this can be either the signed hash value in the catalog file or an embedded signature in the image file itself. The cross-certificates that are used when signing the kernel driver package are used for the load-time signature verification; each certificate in the path is checked up to a trusted root in the kernel. The load-time signature check does not have access to the Trusted Root Certificate Authorities certificate store. Instead,it must depend on the root authorities that are built into the Windows Vista kernel.

如前所述，这也在Requirements for Device Driver Signing and Staging页面上概述：

The 64-bit versions of Windows 7 and Windows Server 2008 R2 have special signature requirements for kernel mode device drivers. If you use a 64-bit version of Windows,then you cannot create your own certificate for signing. Instead,you must use a Software Publishing Certificate that chains to an approved certification authority (CA).

用于签名内核模式驱动程序的有效CA可以在以下页面找到：

Cross-Certificates for Kernel Mode Code Signing

（编辑：李大同）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!