[Bug]: Drivers not properly signed for Windows 11 ARM

[talynone]

Which OS?

Win11 Pro

Which release?

Other..

Driver Version

25.7.23

Device Specifications

Lenovo Yoga Slim 7x (Snapdragon X Elite) Windows 11 PRO 25H2

Describe the bug

Drive fails to install, I even tried manually export the root/mid and driver certificate (all three) and importing them to local machine trust root, but they still won't install.

When trying to install via right click .inf file and choosing install I get:

When trying with pnputil I get:

This is what my store looks like:

I believe Windows 11 ARM has stricter driver signing requirement that is failing with VDD. I'd like to be able to install this without turning off driver signing which was the only solution someone on discord says worked for them.

[fanfan42]

Hi,
I didn't make any test on ARM64 Windows but can you try to remove the Sign Path foundation certificates from "Trusted Root Certification Authority" and try to install them in "Trusted Publishers" ? Still on Local Machine certificates of course

[talynone]

Hi, I didn't make any test on ARM64 Windows but can you try to remove the Sign Path foundation certificates from "Trusted Root Certification Authority" and try to install them in "Trusted Publishers" ? Still on Local Machine certificates of course

Removing the Sign Path foundation certificates from "Trusted Root Certification Authorities" and adding to "Trusted Publishers" made no difference.

[fanfan42]

OK, please remove any sign path foundation certificate and try this script on a powershell with administrator rights:

$ErrorActionPreference = "Stop"
# Start transcript logging
$logFile = "C:\VDDInstall.log"
Start-Transcript -Path $logFile -Force
Write-Output "===== Starting Virtual Display Driver installation ====="
Write-Output "Script running as user: $([Security.Principal.WindowsIdentity]::GetCurrent().Name)"

try {
	$tempDir = "C:\VDDInstall"
	Write-Output "Creating temporary directory: $tempDir"
	New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
	
	# --- Download and extract nefcon ---
	$nefconUrl = "https://github.com/nefarius/nefcon/releases/download/v1.14.0/nefcon_v1.14.0.zip"
	$nefconZipPath = Join-Path $tempDir "nefcon.zip"
	Write-Output "Downloading nefcon from: $nefconUrl"
	Invoke-WebRequest -Uri $nefconUrl -OutFile $nefconZipPath -UseBasicParsing -ErrorAction Stop	
	Write-Output "Extracting nefcon to: $tempDir"
	Expand-Archive -Path $nefconZipPath -DestinationPath $tempDir -Force -ErrorAction Stop
	$nefconExe = Join-Path $tempDir "ARM64\nefconw.exe"
	Write-Output "nefcon executable path: $nefconExe"
	
	# --- Download and extract the driver ---
	$downloadUrl = "https://github.com/VirtualDrivers/Virtual-Display-Driver/releases/download/25.7.23/VirtualDisplayDriver-ARM64.Driver.Only.zip"
	$driverZipPath = Join-Path $tempDir "driver.zip"
	Write-Output "Downloading driver package from: $downloadUrl"
	Invoke-WebRequest -Uri $downloadUrl -OutFile $driverZipPath -UseBasicParsing -ErrorAction Stop
	Write-Output "Extracting driver package to: $tempDir"
	Expand-Archive -Path $driverZipPath -DestinationPath $tempDir -Force -ErrorAction Stop
	
	# --- Extract certificates from .cat file ---
	Push-Location $tempDir
	Write-Output "Current working directory: $(Get-Location)" 
	$catFile = Join-Path $tempDir "VirtualDisplayDriver\mttvdd.cat"
	Write-Output "Reading catalog file: $catFile"
	$catBytes = [System.IO.File]::ReadAllBytes($catFile)
	$certificates = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
	$certificates.Import($catBytes)
	$certsFolder = Join-Path $tempDir "ExportedCerts"
	Write-Output "Creating certificate export folder: $certsFolder"
	New-Item -ItemType Directory -Path $certsFolder -Force | Out-Null
	foreach ($cert in $certificates) {
		Write-Output "----- Certificate detected -----"
		Write-Output "Subject: $($cert.Subject)"
		Write-Output "Issuer: $($cert.Issuer)"
		Write-Output "Thumbprint: $($cert.Thumbprint)"
		Write-Output "Valid from: $($cert.NotBefore)"
		Write-Output "Valid until (expiration): $($cert.NotAfter)"
		Write-Output "--------------------------------"
		
		$certFilePath = Join-Path -Path $certsFolder -ChildPath "$($cert.Thumbprint).cer"
		Write-Output "Exporting certificate: $certFilePath"
		$cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert) | Set-Content -Path $certFilePath -Encoding Byte
		Write-Output "Adding certificate to TrustedPublisher store"
		Start-Process -FilePath "certutil.exe" -ArgumentList "-addstore TrustedPublisher `"$certFilePath`"" -Wait -WindowStyle Hidden
	}
	
	# --- Install the driver ---
	Write-Output "Installing driver using nefcon..."
	& $nefconExe install .\VirtualDisplayDriver\MttVDD.inf "Root\MttVDD"
	Write-Output "Waiting 10 seconds for installation to stabilize"
	Start-Sleep -Seconds 10
	Pop-Location
	Write-Output "Returned to previous directory"
} catch {
	Write-Error "Error in SystemDriverInstall.ps1 : $_"
} finally {
	Write-Output "Cleaning up temporary directory: $tempDir"
	#Remove-Item -Path $tempDir -Recurse -Force -ErrorAction SilentlyContinue
	Write-Output "===== Script completed ====="
	Stop-Transcript
}
exit 0

It gives you a log file found at C:\VDDInstall.log, please copy the content and send it in this issue. It will clarify right now if the certificates are still in usage or not

[talynone]

@fanfan42 Thanks, I've attached the log file.

VDDInstall.log

[fanfan42]

OK, from this file, I'm sure the problem doesn't come from the certificates. it's valid, at least, until 2027. If the script worked, you should have 3 certificates on Local Machine certificates -> Trusted Publishers and the driver musts be installed. But I suppose it's still an "Unknown device" ?

[talynone]

OK, from this file, I'm sure the problem doesn't come from the certificates. it's valid, at least, until 2027. If the script worked, you should have 3 certificates on Local Machine certificates -> Trusted Publishers and the driver musts be installed. But I suppose it's still an "Unknown device" ?

Correct, unknown device.

Form what I've read you cannot "self-sign" a production kernel driver for Windows 11 ARM using just a standard certificate. All drivers must be submitted to the Microsoft Hardware Developer Center (Partner Center) to receive a Microsoft signature.

https://learn.microsoft.com/en-us/answers/questions/2325755/signed-arm64-native-printer-driver-will-not-instal

[fanfan42]

I correct what I said before. According to Copilot asking him to validate the .inf file on an ARM64 Windows, even if the certificates are valid, it won't install and blame the trust chain because (Copilot explanation):

Windows 11 25H2 ARM64 will not load or install a UMDF + IddCx display driver unless it is WHQL‑signed. This is not a theory — it is a documented enforcement starting with Windows 11 24H2 and even stricter in 25H2.

Windows on ARM64 enforces:

• Mandatory kernel-mode code integrity (KMCI). Even for UMDF drivers, because IddCx interacts with the graphics stack.
• No cross-signed drivers allowed. Cross-signing (self-signed + catalog) was allowed on Windows 7–10. It is blocked on Windows 11 ARM64.
• Only WHQL-signed or EV-signed drivers load. And for display drivers (IddCx), WHQL is mandatory.

4 blockers in the .inf file (still according to Copilot):

• PnpLockdown=1 . This means Windows will only install the driver if it is WHQL-signed, TrustedPublisher signatures are ignored, EV signatures are ignored, Test signing is ignored. On Windows 11 ARM64, this is enforced strictly. installation failure guaranteed
• UmdfExtensions = IddCx0102 . IddCx is part of the Windows Display Driver Model (WDDM). Microsoft requires all display drivers must be WHQL-signed, even virtual ones (Applies to x64 and ARM64 and UMDF display drivers). Even though the certificate is fine, Windows is rejecting the type of signature, not the certificate itself. This is why the system reports: “The certificate is invalid or missing”
• Root\MttVDD . Root-enumerated drivers are treated as system-level, security-sensitive, requiring WHQL. This is why even after importing the certificates, Windows refuses.
• Windows 11 ARM64 does NOT allow local driver signing. On x64, you can still install locally signed drivers if Secure Boot is disabled and Test signing is enabled. On ARM64, Secure Boot cannot be disabled, Test signing cannot be enabled, Bootloader enforces KMCI always on

Proposed solutions (again, Copilot):

Your driver cannot be installed on Windows 11 ARM64 unless:

You submit it to Microsoft Hardware Dev Center and obtain a WHQL signature.
OR
You sign it with an EV certificate and the driver does not fall under categories requiring WHQL (but IddCx does require WHQL).

So in your case:

👉 WHQL is the only viable path.
@itsmikethetech @zjoasan