If a HAL extension is test signed by using a previously released version of the "Windows OEM HAL Extension Test Cert 2017 (TEST ONLY)" certificate, the extension does not load even if the TESTSIGNING boot configuration option is enabled.


To fix this issue, download and install the updated version of the "Windows OEM HAL Extension Test Cert 2017 (TEST ONLY)" certificate. The new version lets you test sign HAL extensions for use on systems that have the TESTSIGNING boot configuration option enabled. This update also provides a replacement for Windows Phone OEM 2013 test certificates.

The download also contains a fix for an issue that affects the WDK, EWDK, and ADK kits in Windows 10 Version 1709 and later versions. This issue causes signtool to default to expired Windows Phone OEM 2013 test certificates. This fix forces signtool to use the newer Windows OEM 2017 test certificates.

More information


To install this update, you must have the Windows 10 Version 1709 or a later version WDK, EWDK, or ADK installed.

Registry information

To apply this update, you don't have to make any changes to the registry.

Restart requirement

You do not have to restart the computer after you apply this update.

Update replacement information

This update does not replace a previously released update.


Microsoft has confirmed that this is an issue in the Microsoft products that are listed in the "Applies to" section.


Learn about the terminology that Microsoft uses to describe software updates.

Need more help?

Expand your skills


Get new features first


Was this information helpful?

What affected your experience?

Thank you for your feedback!