** Windows 10 now requires an EV code signing certificate for kernel mode driver signing. Stay tuned -- we will be offering EV certificates soon.

As of late August 2013, all valid (not expired, not revoked) Comodo Code Signing Certificates can be used for Kernel-Mode Code Signing! (For Windows Vista through Windows 8.1). Windows 10 requires an EV (Extended Validation) certificate, which we do not yet offer.

  1. Download the Comodo cross-signed CA that matches your Code Signing certificate's Root CA.

  2. Open an elevated Windows command prompt (cmd) and run signtool.exe:

    signtool.exe sign /v /p <your PFX password> /ac "CROSS_SIGNED_COMODO_CA_HERE" /f YOUR_PFX_HERE /tr http://timestamp.comodoca.com/rfc3161 "FULL_PATH_TO_FILE_TO_SIGN"

    Example: signtool.exe sign /v /p <your PFX password> /ac "AddTrustExternalCARoot_kmod.crt" /f my.pfx /tr http://timestamp.comodoca.com/rfc3161 "C:\myfile.dll"

Note: For most customers CROSS_SIGNED_COMODO_CA_HERE will be:




OR (for newer RSA/SHA256 Certificates)


For more general information and instruction about kernel mode signing certificates, see Microsoft's Kernel-Mode Code Signing Walkthrough. (MSDN.microsoft.com)