Practical Windows Code and Driver Signing discussion

Question

Hello, my name is David Grayson and I work at Pololu Robotics & Electronics. I recently went through the process of signing all of our company's USB drivers and most of our installers for Windows. I encountered
so many problems along the way that could have been easily avoided if someone had told me about them ahead of time. In response, I have written a 7000-word document that hopefully explains everything you need to know about code and driver signing:
Practical Windows Code and Driver Signing
If you are going through the same process, I sincerely hope that this document can clear up all of your confusion and save you a lot of time. I learned the hard way and now you can learn the easy way.  The basic conclusion of it
all is that you should probably stay away from Go Daddy's certificates and use GlobalSign, and I provide detailed justifications for that.
Click here to read the entire document.
If you have any comments or questions, please post them here! If I missed anything or got anything wrong, let me know.  If you found the document useful and just want to thank me, then you can do that here too!
Also, if you found this document helpful, please click on the little green arrow to the left!
--David Grayson

Answer 1

David, 
Thanks! Sorry, I would have replied earlier but got diverted to the latest crisis.
David Wrote:
"I don't know anything about a Go Daddy "Driver Signing Tool"; maybe you found that statement elsewhere."
My bad, I meant to say Godaddy's "Driver Signing Cert" as opposed to their "Code Signing Cert".
And Yes, I followed your instructions and everything works fine on Win7 now that I installed the root certs you recommended!!
Still I must find a way for my driver package to install without the warning message in Win7 without having users install the cert.
Godaddy support (I have little confidence in them) swears up and down that I can double sign my Catalog file by following instructions here:
http://msdn.microsoft.com/en-us/library/windows/hardware/hh967734%28v=vs.85%29.aspx
Signing a driver package with two signatures
In some cases, you might want to sign a driver package with two different signatures. For example, suppose you want your driver to run on Windows 7 and Windows 8. Windows 8 supports signatures created with the SHA256 hashing algorithm, but Windows 7
does not. For Windows 7, you need a signature created with the SHA1 hashing algorithm.
Suppose you want to build and sign a driver package that will run on Windows 7 and Windows 8 on x64 hardware platforms. You can sign your driver package with a primary signature that uses SHA1. Then you can append a secondary signature that uses SHA256.
You can use the same certificate for both signatures, or you can use separate certificates. Here are the steps to create the two signatures using Visual Studio.
In the Solution Explorer window, right-click Solution SolutionName, and choose Configuration Manager. For the driver project and the package project, set Configuration to Win7
Release, and set Platform to x64.
Open the property pages for the driver package. Navigate to Configuration Properties > Driver Signing > General. In the Sign Mode drop-down list, select Production Sign. For Production
Certificate, enter the path to your signing certificate.
In the property pages for the driver package, navigate to Configuration Properties > Custom Build Step > General. For Description, select Performing Custom Build Step. For Execute
After, selectDriverProductionSign. For Command Line, enter this command.
Signtool sign /fd sha256 /ph /as /sha1 XX...XX $(TargetPath)
where XX...XX is the hash of the certificate you are using for the the secondary signature.
Note  To see the hash (also called the thumb print) of a certificate, open a Command Prompt window and navigate to the directory that contains your certificate. Enter the command certutil -dump CertName.pfx,
whereCertName.pfx is the name of your certificate.
From what I gather, the issue is:
1. Godaddy's "Driver Signing Certs" defaults to signing with a SHA 256. For whatever reason, most Win7 installations do not have the appropriate root cert installed to support SHA 256.
2. According to Godaddy if I resign my Catalog file again with SHA1 then everything should work. They claim they have done this with other users.
3. According to Microsoft the  Signtool utility used with following parameters will resign a Catalog that's already signed with SHA1 to SHA256.
Signtool sign /fd sha256 /ph /as /sha1 XX...XX $(TargetPath)
But I need to resign to SHA1. If I can resign to SHA1, then everything should work properly with the GoDaddy root that's installed normally in Win7 machines.
Questions:
1. Is Godaddy giving me bad info? According to them I can sign my Catalog file twice with the same cert. According to you I will need another cert.
2. If I can double sign the Cat file, what are the proper Signtool parameters to make sure its signed again with SHA1.
The Microsoft sample is for going from SHA1 to SHA256, but I'll need to go from SHA256 to SHA1. If I was using Godaddy's Code Signing Cert this would be an issue.
Thanks
Randy
Randy Feingersh