In any organization that works with Windows, digital certificates, driver signatures, and cryptographic devices have become commonplace. Whether you manage just a few PCs or an entire domain, if you want security, strong authentication, and control over the software that is installed, you need to understand how this ecosystem works.
In addition to the typical certificates required by the tax authorities or social security, in professional environments it's crucial to know how to manage user certificates, controller certificates, internal certification authorities, and tools like Adobe, browsers, and tokens . It sounds complicated, but if we break it down step by step, you'll see it's quite manageable, provided you understand the concepts and follow certain best practices.
What is a digital certificate and why is it so important in Windows?
A digital certificate is essentially an electronic document that acts as your ID card online . It is issued by a recognized Certification Authority (CA). It serves to uniquely identify a person, a company, or even a server or website.
This certificate includes the holder's identifying information (name, tax ID number, organization, etc.) that the Certificate Authority has previously verified. Thanks to this, we can use it to sign documents, authenticate ourselves to government agencies, or validate that a website or controller is considered trustworthy.
In the Windows world, these certificates allow you to electronically sign documents, programs, and drivers, and to establish secure connections . That's why it's so important to manage them properly: install them where they belong, renew them before they expire, export backups, revoke them if there are problems, and don't delete them indiscriminately.
There are certificates for almost everything: personal, business, website, controller, root, intermediate, client, server , and many more. Windows stores them in different "stores" that are accessed by applications such as Edge, Chrome, Adobe Reader, AutoFirma, and administrative tools.
Types of digital certificates you will encounter
Within the Windows ecosystem, you will encounter different types of certificates depending on their use and owner . These are:
- Personal certificatesThese are issued in the name of an individual. We use them to identify ourselves in online procedures, sign PDF documents, access the Spanish Tax Agency (AEAT), the Spanish Traffic Authority (DGT), the Social Security Administration, etc.
- Entity certificates. These are documents associated with a company, association, or organization. The entity itself signs or identifies itself, even if the document is used by an authorized representative. They are used to file company taxes, sign corporate documents, or interact with government agencies on behalf of the organization.
- Electronic headquarters certificatesThey identify an official website or portal as belonging to a public administration or entity, guaranteeing that the site is legitimate and that communication is protected.
In the Windows certificate store, you'll also see categories such as Trusted Root Issuing Authorities, Intermediary Authorities, Other Users, Client Authentication , and "non-removable certificates." These are components of the trust chain that allow you to validate the final certificates.
Code signing certificates and driver signing in Windows
When we talk about drivers and software in Windows, code signing certificates come into play . Their function is to guarantee that a program or driver was issued by a specific publisher and has not been modified since it was signed.
In the specific case of kernel-mode drivers, Windows is particularly strict. Starting with Windows 7 (patched for SHA-256) and Windows 8 , and even more so with Windows 10, drivers must be signed with secure algorithms (such as SHA-256) and, in many cases, with Extended Validation (EV) code-signing certificates.
The SignTool , which is part of the Windows SDK, is commonly used to sign drivers . It allows you to specify options such as the certificate, the PFX password, the hash algorithm, additional certificates (for example, the Microsoft cross-certificate), and the timestamp server.
Key SignTool parameters are /f to specify the PFX file, /p for the password, /fd for the hash algorithm (e.g., /fd sha256), /ac to add the cross-certificate, /tr to configure an RFC 3161 timestamp server, and /n to choose a specific certificate from the store by its common name.
Once the driver binaries (usually the .sys and .cat files) are signed, you can verify the signature with `signtool verify -v -kp` , which validates according to the specific criteria for kernel-mode drivers. See the sigcheck guide for additional verification tools. If everything is correct, Windows will install the driver, displaying the publisher as "known and trusted".
Prerequisites: Hardware Developer Program and EV certifications
If you're going to publish drivers through the Microsoft ecosystem, as a Partner Center administrator for hardware , you'll need to handle adding, updating, and removing code signing certificates associated with your organization.
The first step is to register for the Microsoft Hardware Developers Program . If your company account doesn't already exist, you'll need to complete the registration process by following the steps and linking your organization.
To upload and sign drivers, you need a code signing certificate, preferably EV , issued by a trusted provider. If your company already has a valid certificate, you can reuse it. Otherwise, you'll need to acquire one through a recognized Certificate Authority (CA). The CA will verify your company's identity (documentation, contact information, phone number, etc.) and, once approved, will provide instructions for downloading the certificate.
In modern environments, it is essential to work with SHA-2 (SHA-256) based certificates and timestamps . Support for SHA-1 is being phased out in practice for newer applications, such as code signing certificates and timestamping servers.
How to add, renew, or revoke code signing certificates in the Partner Center
With the EV or standard certificate already issued, the next step is to add it to the hardware panel in the Partner Center so that Microsoft recognizes it when signing and validating your drivers. Here are the steps:
- Log in to the portal with hardware account administrator credentialsFrom there, access the gear icon in the upper right corner and enter the account settings or developer settings section.
- Click on the option “Manage certificates” (in the side menu).
- Choose “Add a new certificate” and proceed with the wizardThe portal will allow you to download a binary file (usually Signablefile.bin) that you will need to sign locally using SignTool with your code signing certificate and the SHA-256 algorithm, along with a valid SHA-2 timestamp.
- Finally Upload the certificate back to the Partner CenterMicrosoft will validate that the signature matches a certificate issued to your organization and, if everything is correct, will add that certificate to the list of accepted code signing certificates for your account.
How to view and manage certificates installed on Windows
All the certificates you install, both personal and system, are stored in the Windows Certificate Manager . From there, applications check which certificates are available for authentication, signing, or encryption.
To review computer (machine-level) certificates used by the system and many services, you can use the command certlm.msc from the search bar or the Run dialog box (Win + R). This will open the Local Computer Certificates console with various folders categorized by purpose.
To view your personal user certificates , use the certmgr.msc tool . Here you'll find certificates linked only to your Windows profile: those you use for administrative tasks, work certificates, those installed by certain applications or browsers, and so on.
For more advanced users, it's also possible to check for the presence of certificates in the Windows Registry . For example, the current user's certificates are stored in paths such as HKEY_CURRENT_USER/Software/Microsoft/SystemCertificates/CA/Certificates, while certificates associated with Group Policy Objects (GPOs) are found in branches under HKCU/Software/Policies/Microsoft/SystemCertificates.
In many cases it is not necessary to touch anything in the Registry, but it is useful to know about it if you have to diagnose problems with certificate loading, duplicates or policies applied by domain.
Exporting, backing up, and deleting certificates in Windows
If you frequently work with certificates, it's essential to have a backup strategy . Losing a certificate without a backup could mean having to repeat the entire application and in-person accreditation process.
Windows allows you to export certificates from the Certificate Manager . Simply locate the certificate in its folder, right-click, go to "All Tasks," and select "Export." A wizard will open asking if you want to include the private key and what export format you prefer.
To move a personal certificate to another computer or save it to a USB drive, the usual method is to generate a password-protected PFX/P12 file . This way, by double-clicking it on another computer and providing the password, you can install the certificate along with its associated private key.
Regarding deletion, you must be especially careful. In the same certificate manager, selecting a certificate and choosing the delete option removes it from the certificate store, making it unavailable to Windows and any applications . If you make a mistake, you can break authentication, prevent the use of programs, or even affect system stability.
Therefore, it's recommended not to randomly delete system certificates and to always make a backup beforehand , especially if you're unsure of the purpose of each one. The same applies to user certificates that are still valid and that you might need later.
Smartcards, cryptographic tokens and Bit4id PKI Manager
In many companies and public organizations, certificates are not stored on the computer's hard drive, but on smartcards or cryptographic USB tokens . This adds an extra layer of security, as the private key never leaves the physical device.
One of the common tools for managing these devices is Bit4id PKI Manager , which communicates with tokens and cards to unlock, change PIN/PUK, import certificates, export public keys, and much more. By default, it runs in user mode, but you can enable advanced options with the keyboard shortcut Ctrl + A.
From the device panel, you can view information about the reader, the card, the PIN and PUK status, and the list of stored user and CA certificates . If the PIN is locked or you don't remember it, you can use the PUK unlock function, provided you haven't reached the maximum number of attempts.
In addition, the PKI Manager allows you to change the PIN if you suspect someone else knows it , change the PUK, log in and out of the device, update the content to display new certificates, and rename the device for better identification.
Importing certificates to the card is typically done using .p12 or .pfx files that include the private key. You must specify the device PIN, the password for the PFX file, and optionally, a CKA_ID identifier useful for certain PKCS#11 applications.
To export, only the public key in .cer format is extracted , never the private key . This is useful for sharing the certificate with third parties or installing the public key where needed to verify signatures or authentications. ( See risks of connecting unknown USB drives ).
Advanced configuration and certificate upload checks
In the Bit4id PKI Manager toolbar you will also find a shortcut to the Windows certificate store , where you can see how the card certificates are copied to the user's "Personal" folder, if that integration is enabled.
The middleware configuration panel allows you to adjust parameters such as automatic import of CA certificates from P12/PFX, log generation, middleware cache clearing, and integration with Microsoft's CryptoAPI/CSP . This last option is key if you want Windows applications (including Edge or Chrome) to see the token certificates directly.
If you're having problems, it's a good idea to do several checks :
- Verify that the certificates appear in certmgr.msc (user).
- Make sure they are loaded in Firefox (in its internal store), or that Edge or Chrome can see them from their certificates section.
- Verify that Adobe Reader detects Windows digital IDs.
In Adobe, for example, you can list the "Windows Digital IDs" to confirm that the card certificate is displayed correctly. If it doesn't appear, the problem could be with the middleware, the reader, the PIN, or some system integration setting.
Auxiliary programs and professional certificate managers
Certificates alone don't work miracles. To get the most out of them, you need applications that use them for authentication, document signing, encryption, or connecting to public services . In Spain, there are several programs that are practically mandatory.
On one hand, there's the FNMT-RCM Configurator , which simplifies key generation and obtaining FNMT certificates. Also well-known is AutoFirma , developed by the Ministry of Finance, which integrates with government browsers and websites to electronically sign forms and documents.
Many of these applications rely on the Java Runtime Environment (JRE) . Not just any version will do: sometimes specific ranges are recommended (for example, from version 8 Update 45 to certain later versions). It's always a good idea to check the requirements of each portal.
There are also utilities such as CERES Certificate Management, PKCS#11 cryptographic modules and specific drivers for working with cryptographic cards, which add compatibility with Firefox and other environments, or facilitate PIN changes, unlocking and viewing of certificates.
In professional settings, where dozens or hundreds of certificates are managed (consulting firms, management companies, law firms, etc.), specialized software such as DigiCert Certificate Utility for Windows or ADMCert is used . These programs allow for the inventorying of certificates, the application of usage policies, control over who uses them, from where and for what purpose, and the detection of configuration problems or upcoming expirations.
With tools like this, you can configure rules based on users or Active Directory groups, schedules, source IPs, or applications that call the certificate. This is essential for maintaining order and security when certificates are no longer just for isolated users.
Active Directory Certificate Services and internal certification authority
In corporate Windows environments, it is very common to deploy an internal Certificate Authority using Active Directory Certificate Services (AD CS) . This allows you to issue certificates for users, computers, servers, VPNs, corporate Wi-Fi, internal code signing, etc., without always relying on an external CA.
The installation is performed from Server Manager by adding the Active Directory Certificate Services role . The wizard will prompt you to select the server, check the Certification Authority role, and optionally, the CA Web Enrollment role, which will also require adding features such as IIS.
After installing the role, you must run the AD CS configuration wizard. There you choose the roles to configure (CA and CA Web Enrollment), the CA type (usually enterprise), and the entity type (often root CA if it's the first one) . You'll need to decide whether to create a new private key, the cryptographic algorithm (SHA-256 is recommended), and the key size, as well as the CA name and the validity period of the root certificate.
The configuration also includes the paths where the certificate database and logs will be stored . It's advisable to keep these paths well-documented, as you'll need them for future backups, restores, and migrations.
Once the CA is configured, you can issue certificate templates, automate enrollment via GPO , publish computer and user certificates in Active Directory, and create a complete ecosystem of internal certificates integrated with your domains.
Given this overview, managing certificates and driver signatures in Windows requires a clear understanding of the basics. It's essential to always apply best practices: never share keys, create backups, monitor expiration dates, revoke certificates if you suspect something is amiss, and avoid deleting anything without knowing what it is . With this foundation, navigating this area ceases to be a headache and becomes simply another part of daily system administration.
