title: Intricacies of Windows driver signing (re-naming and re-signing OpenVPN tap driver)
body: <p>I'm unclear how a driver should be signed in my specific circumstances.</p>
  
  <p>OpenVPN has a tap driver that consists of tap0901.sys, tap0901.cat and OemWin2k.inf files.</p>
  
  <p>When I install it using "devcon install OemWin2k.inf tap0901" on my win7 64-bit, it installs silently, without scary warnings.</p>
  
  <p>I renamed the driver to have a different name ogtap100 (by renaming files to ogtap100.sys, ogtap100.cat and replacing "tap0901" strings in OemWin2k.inf to "ogtap100", as per <a href="http://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers" rel="nofollow">http://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers</a> and comments in OemWin2k.inf).</p>
  
  <p>However, when I run "devcon install OemWin2k.info ogtap100" on the renamed driver, I get big scary warning from Windows that the driver comes from unknown source. It'll install but I plan to ship it as part of my app, so big scary warning is not good.</p>
  
  <p>When I run "signtool verify /v ogtap100.cat", I get: "SignTool Error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider." even though it also says that root certificate is "Issued to: DigiCert High Assurance EV Root CA".</p>
  
  <p>I've tried re-signing (signtool sign /f cert.pfx ogtap100.cat) with my own certificate (which works when signing regular .exe files) but I get the same scary warning.</p>
  
  <p>What am I missing?</p>
  
  <p>Can it be sth. to do with catalog (.cat) file?</p>
  
  <p>I've read <a href="http://msdn.microsoft.com/en-us/windows/hardware/gg463050" rel="nofollow">http://msdn.microsoft.com/en-us/windows/hardware/gg463050</a> but it assumes that I'll generate .cat file myself. I already have .cat file from OpenVPN. Do I have to re-generate it after renaming files and OewmWin2k.inf? If yes, how?</p>