Forum Discussion
Driver digital signature authentication issues
I am currently developing a desktop application for my company with a kernel driver (which is just a single .sys file). Since drivers must have a Microsoft digital signature to run starting with Windows 10, I have some questions about digital signature authentication.
On this webpage (https://learn.microsoft.com/zh-cn/windows-hardware/drivers/dashboard/driver-signing-offerings#hardware-lab-kit-tested-and-dashboard-signed-drivers), I saw a solution for driver signing. The first method requires testing with HLK and submission to Windows Hardware Quality Labs for certification. The second method, according to its description, only requires submitting the driver for signature verification, without HLK testing. What are the differences between these two solutions? Which solution should I choose?
1 Reply
Both submissions can produce a Microsoft-trusted signature, but provide different assurances and distribution rights. An HLK-tested submission validates compatibility, is Microsoft’s recommended production route, can qualify as Windows Certified, supports retail Windows Update distribution, and is required for relevant Windows Server drivers. Attestation skips HLK and proves package trust, not compatibility or functionality. Microsoft describes attestation as testing-only for Windows 10 desktop and later; those drivers cannot reach retail audiences through Windows Update. For a customer-shipped kernel driver, use HLK and the Windows Hardware Compatibility Program unless Microsoft documents an exception for that driver class. Build a complete INF, catalog, and driver package, test each target architecture and Windows release, run the applicable HLK playlist, and submit the resulting package through Partner Center. Use attestation only for controlled client testing, not as a substitute for production qualification.
