title: Dual-sign .cat file has error "No signature was present in the subject"
body: <p>I'm dual-signing a windows .sys and .cat files for a driver using a certificate purchased from Symantec  with the following command lines (the sys and cat files are both signed with the same options):</p>
  
  <p><code>signtool.exe sign /v /ph /n "MyCorp" /ac "C:\Signing\VeriSign Class 3 Public Primary Certification Authority - G5.cer" /i "VeriSign Class 3 Code Signing 2010 CA" /t "http://timestamp.verisign.com/scripts/timstamp.dll" "MyDriver.cat"</code></p>
  
  <p><code>signtool.exe sign /v /ph /n "MyCorp" /ac "C:\Signing\VeriSign Class 3 Public Primary Certification Authority - G5.cer" /i "Symantec Class 3 SHA256 Code Signing CA" /tr "http://timestamp.geotrust.com/tsa" /as /fd sha256 /td sha256 "MyDriver.cat"</code></p>
  
  <p>Signtool.exe reports success when it exits. When I view the signatures by right clicking the signed files, choosing Properties, go to Digital Signatures tab, then I see the two signatures. The sha1 signature seems fine. When I view the details of the sha256 certificate on the .sys file, everything looks good. But, when I view the details of the sha256 certificate on the .cat file, I see the following error:</p>
  
  <p><a href="https://i.stack.imgur.com/j9Com.png" rel="noreferrer"><img src="https://i.stack.imgur.com/j9Com.png" alt="enter image description here"></a></p>
  
  <p>The driver won't install on a Window7 box that I configured to believe SHA1 was deprecated on 1st January 2015 (rather than the real date when they expire which is 1st Jan 2016).</p>
  
  <p>I saw a note on this <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/dn741532%28v=vs.85%29.aspx?f=255&amp;MSPPError=-2147217396" rel="noreferrer">msdn page</a> saying:</p>
  
  <blockquote>
    <p>Note that only .sys files can be dual signed because they are PE
    files.</p>
  </blockquote>
  
  <p>Is that quote trying to say in a roundabout way that .cat files cannot be dual signed?</p>
  
  <p>How should cat files be signed so that they will install on all versions of windows?</p>