The kernel-mode code signing policy requires that a kernel-mode driver be test-signed and that test-signing is enabled. A test signature can be a WHQL test signature or generated in-house by a test certificate. Drivers must be test-signed as follows: A kernel-mode boot-start driver must have an embedded test signature.

When you want to run a code-signing exercise with the kernel mode, you can choose two methods, the Extended Validation (EV) code signing or the Organization Validation (OV) code signing certificate. The kernel mode code has a.sys extension, and for these drivers to load properly, they must be signed effectively with the security catalog (CAT).