为MSI/可执行文件交叉签名是否有益？内核驱动为何要求交叉签名？

Great question—let's unpack this from both the user-space (EXE/MSI) and kernel-space perspectives, since Windows treats these two execution layers very differently.

一、EXE/MSI安装包做交叉签名：几乎无必要，益处极有限 #

Cross-signing was built specifically for kernel-mode code, and for user-space binaries like EXEs or MSIs, it's generally not a useful or recommended practice. Here's why:

• User-space trust model doesn’t require it: Windows validates user-space code using its standard code-signing infrastructure. A regular code-signing certificate from a trusted CA is enough to get your EXE/MSI past SmartScreen warnings, avoid "unknown publisher" errors, and be recognized as legitimate by the OS. Cross-signing adds no extra trust or validation benefits here.
• Unnecessary complexity & cost: Adding a cross-sign step to your EXE/MSI signing workflow just introduces extra steps, potential for errors, and may even add additional costs (if you’re paying for cross-certificate access). There’s no tangible upside for modern Windows versions.
• Edge case for legacy systems (mostly obsolete): The only hypothetical benefit might be for extremely old Windows versions (like XP or Vista) where your CA's root certificate isn’t pre-installed. A cross-signature could chain to a root that is trusted by those systems—but since these OS versions are long out of support, this scenario is basically irrelevant today.

二、为什么内核模式驱动强制要求交叉签名？ #

Kernel-mode code runs with full system privileges, so Windows enforces far stricter security controls here. Cross-signing is non-negotiable for a few critical reasons:

• Kernel-level trust chain requirement: Windows kernel only trusts code signed via a chain that leads to Microsoft's own trusted root certificates. Most code-signing CAs aren’t directly authorized to issue kernel-mode signing certificates—instead, they use Microsoft-issued cross-certificates to link their own certificates to Microsoft's trusted roots. This ensures the kernel only loads code that's been vetted through a Microsoft-approved trust path.
• Secure Boot compatibility: For systems with Secure Boot enabled (mandatory on modern Windows PCs), cross-signing is a hard requirement. Secure Boot blocks any unsigned or untrusted kernel code from loading, and cross-signing provides the necessary chain of trust to prove the driver has been validated against Microsoft's security standards.
• Mitigating kernel-level threats: Kernel drivers have unrestricted access to system memory, hardware, and processes. Cross-signing prevents malicious actors from using self-signed or untrusted certificates to load rogue drivers that could compromise the entire system. It adds a critical layer of validation that user-space code doesn’t need, given its limited privileges.

内容的提问来源于stack exchange，提问作者rollsch