MakeCert Test Certificate
A MakeCert test certificate is an X.509 digital certificate that is created by using the command-line CryptoAPI MakeCert tool. A MakeCert test certificate is a self-signed root certificate that can be used to test-sign a driver package's catalog file or to test-sign a driver file by embedding a signature in the driver file.
To create a MakeCert test certificate, use the MakeCert tool as follows:
MakeCert -r -pe -ss TestCertStoreName -n "CN=CertName" CertFileName.cer
The -r option specifies that the certificate is self-signed, that is, the certificate is a root certificate.
The -pe option specifies that the private key that is associated with the certificate can be exported.
The -ss TestCertStoreName option specifies the name of the certificate store that contains the test certificate.
The -n "CN=CertName" option specifies a name for the certificate that can be used with the SignTool tool to identify the certificate. We recommend that you use a certificate name that clearly identifies the certificate as a test certificate, for example, "WDK Driver Testing Cert - for in-house use only." If the certificate name is not supplied, the default name of the certificate is "Joe's Software Emporium."
CertFilename.cer is the file name that contains a copy of the test certificate. The certificate file is used to add the certificate to the Trusted Root Certification Authorities certificate store and the Trusted Publishers certificate stores.
The certificate store that contains the test certificate is added to the list of certificate stores that Windows manages for the user account on the development computer on which the certificate store was created.
A developer has to create only one MakeCert test certificate to sign all driver packages on a development computer.
In the following example, the MakeCert command generates a test certificate named "Contoso.com(Test)", installs the test certificate in the PrivateCertStore certificate store, and creates the Testcert.cer file that contains a copy of the test certificate.
MakeCert -r -pe -ss PrivateCertStore -n "CN=Contoso.com(Test)" testcert.cer
To test-sign a catalog file or embed a signature in a driver file, the MakeCert test certificate can be in the Personal certificate store ("my" store), or some other custom certificate store, of the local computer that signs the software. However, to verify a test signature, the corresponding test certificate must be installed in the Trusted Root Certification Authorities certificate store of the local computer that you use to verify the signature.
Use the CertMgr tool, as follows, to install a test certificate in the Trusted Root Certification Authorities certificate store of the local computer that you use to sign drivers:
CertMgr /add CertFileName.cer /s /r localMachine root
Before you can install a driver package that is signed by a MakeCert test certificate, the test certificate must be installed in the Trusted Root Certification Authorities certificate store and the Trusted Publishers certificate store of the test computer. For information about how to install a MakeCert test certificate on a test computer, see Installing a Test Certificate on a Test Computer.