Authenticode driver signing for win2003 & Error 0x800b0109

Hi,
I am trying (with no luck) to sign my driver usign authenticode cert
I've bought from verisign.
The driver is intended win2003.
The driver is signed properly and passes signtool.exe verify check.
But when I try to install it on win2003 machine in server-mode install
I get the following error:
Error 0x800b0109: A certificate chain processed, but terminated in a
root certificate which is not trusted by the trust provider.

Any ideas?

Thanks

Thomas
Wed Jul 11 02:47:00 CDT 2007

Depends on the kind of driver...

If the driver has a WHQL test, then Authenticode signing will not work on
WS2003. You must get WHQL signature.

If there is no WHQL test for your device/driver, then it should work...

Good luck,

Thomas F. Divine

<jacob.broido@gmail.com> wrote in message
news:1184136024.900997.82290@o61g2000hsh.googlegroups.com...
> Hi,
> I am trying (with no luck) to sign my driver usign authenticode cert
> I've bought from verisign.
> The driver is intended win2003.
> The driver is signed properly and passes signtool.exe verify check.
> But when I try to install it on win2003 machine in server-mode install
> I get the following error:
> Error 0x800b0109: A certificate chain processed, but terminated in a
> root certificate which is not trusted by the trust provider.
>
> Any ideas?
>
> Thanks
>

jacob
Thu Jul 12 03:32:50 CDT 2007

On Jul 11, 10:47 am, "Thomas F. Divine" <tdivine@NOpcausaSPAM> wrote:
> Depends on the kind ofdriver...
>
> If thedriverhas a WHQL test, thenAuthenticodesigning will not work on
> WS2003. You must get WHQL signature.
>
> If there is no WHQL test for your device/driver, then it should work...
>
> Good luck,
>
> Thomas F. Divine
>
> <jacob.bro...@gmail.com> wrote in message
>
> news:1184136024.900997.82290@o61g2000hsh.googlegroups.com...
>
> > Hi,
> > I am trying (with no luck) to sign mydriverusignauthenticodecert
> > I've bought fromverisign.
> > Thedriveris intended win2003.
> > Thedriveris signed properly and passes signtool.exe verify check.
> > But when I try to install it on win2003 machine in server-mode install
> > I get the following error:
> > Error 0x800b0109: A certificate chain processed, but terminated in a
> > root certificate which is not trusted by the trust provider.
>
> > Any ideas?
>
> > Thanks

The driver is an .inf only file ( and .cat now) , I use it as a dummy
driver to eliminate the 'unknown' devs in device manager.

I've done the signing procedure in any possible way I could think
of... including adding the full chain of CA's and the certificate I
use to the trusted publishers store

Any help?

Thomas
Thu Jul 12 08:47:06 CDT 2007

Sorry, but I don't have a solution.

Is there a need to install the certificates on the server before doing the
install? (I don't know...)
Good luck to you!

Thomas F. Divine

<jacob.broido@gmail.com> wrote in message
news:1184229170.296645.246240@57g2000hsv.googlegroups.com...
> On Jul 11, 10:47 am, "Thomas F. Divine" <tdivine@NOpcausaSPAM> wrote:
>> Depends on the kind ofdriver...
>>
>> If thedriverhas a WHQL test, thenAuthenticodesigning will not work on
>> WS2003. You must get WHQL signature.
>>
>> If there is no WHQL test for your device/driver, then it should work...
>>
>> Good luck,
>>
>> Thomas F. Divine
>>
>> <jacob.bro...@gmail.com> wrote in message
>>
>> news:1184136024.900997.82290@o61g2000hsh.googlegroups.com...
>>
>> > Hi,
>> > I am trying (with no luck) to sign mydriverusignauthenticodecert
>> > I've bought fromverisign.
>> > Thedriveris intended win2003.
>> > Thedriveris signed properly and passes signtool.exe verify check.
>> > But when I try to install it on win2003 machine in server-mode install
>> > I get the following error:
>> > Error 0x800b0109: A certificate chain processed, but terminated in a
>> > root certificate which is not trusted by the trust provider.
>>
>> > Any ideas?
>>
>> > Thanks
>
> The driver is an .inf only file ( and .cat now) , I use it as a dummy
> driver to eliminate the 'unknown' devs in device manager.
>
> I've done the signing procedure in any possible way I could think
> of... including adding the full chain of CA's and the certificate I
> use to the trusted publishers store
>
> Any help?
>