Microsoft Windows kernel's CA certificate and https://www.microsoft.com cert w/ chain

$ openssl s_client -showcerts -connect www.microsoft.com:443 </dev/null > chain-www.microsoft.com.log && curl -sv
https://www.microsoft.com/pki/certs/MicrosoftCodeVerifRoot.crt | openssl x509 -inform der -outform pem -text > MicrosoftCodeVerifRoot.crt
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary
Certification Authority - G5
verify error:num=20:unable to get local issuer certificate
verify return:0
DONE
* STATE: INIT => CONNECT handle 0x800477e8; line 1029 (connection #-5000)
* Hostname was NOT found in DNS cache
*   Trying 96.17.34.111...
* STATE: CONNECT => WAITCONNECT handle 0x800477e8; line 1082 (connection #0)
* Connected to www.microsoft.com (96.17.34.111) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /usr/ssl/certs/ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
} [data not shown]
* STATE: WAITCONNECT => PROTOCONNECT handle 0x800477e8; line 1222 (connection #0)
* SSLv3, TLS handshake, Server hello (2):
{ [data not shown]
* SSLv3, TLS handshake, CERT (11):
{ [data not shown]
* SSLv3, TLS handshake, Server key exchange (12):
{ [data not shown]
* SSLv3, TLS handshake, Server finished (14):
{ [data not shown]
* SSLv3, TLS handshake, Client key exchange (16):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Finished (20):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
{ [data not shown]
* SSLv3, TLS handshake, Finished (20):
{ [data not shown]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-SHA384
* Server certificate:
*        subject: 1.3.6.1.4.1.311.60.2.1.3=US; 1.3.6.1.4.1.311.60.2.1.2=Washington; businessCategory=Private Organization; serialNumber=600413485; C=US; postalCode=98052; ST=Washington; L=Redmond; street=1 Microsoft Way; O=Microsoft Corporation; OU=MSCOM; CN=www.microsoft.com
*        start date: 2014-10-15 00:00:00 GMT
*        expire date: 2016-10-15 23:59:59 GMT
*        subjectAltName: www.microsoft.com matched
*        issuer: C=US; O=Symantec Corporation; OU=Symantec Trust Network; CN=Symantec Class 3 EV SSL CA - G3
*        SSL certificate verify ok.
* STATE: PROTOCONNECT => DO handle 0x800477e8; line 1241 (connection #0)
> GET /pki/certs/MicrosoftCodeVerifRoot.crt HTTP/1.1
> User-Agent: curl/7.39.0
> Host: www.microsoft.com
> Accept: */*
>
* STATE: DO => DO_DONE handle 0x800477e8; line 1314 (connection #0)
* STATE: DO_DONE => WAITPERFORM handle 0x800477e8; line 1441 (connection #0)
* STATE: WAITPERFORM => PERFORM handle 0x800477e8; line 1454 (connection #0)
* HTTP 1.1 or later with persistent connection, pipelining supported
< HTTP/1.1 200 OK
< Content-Length: 1801
< Content-Type: application/x-x509-ca-cert
< Last-Modified: Fri, 09 Dec 2005 23:09:37 GMT
< Accept-Ranges: bytes
< ETag: "ea8851a015fdc51:0"
* Server Microsoft-IIS/8.5 is not blacklisted
< Server: Microsoft-IIS/8.5
< P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
< VTag: 438174315300000000
< X-Powered-By: ASP.NET
< X-Powered-By: ARR/2.5
< X-Powered-By: ASP.NET
< Cache-Control: max-age=878
< Date: Sat, 20 Dec 2014 23:20:02 GMT
< Connection: keep-alive
< X-CCC: US
< X-CID: 2
<
{ [data not shown]
* STATE: PERFORM => DONE handle 0x800477e8; line 1626 (connection #0)
* Connection #0 to host www.microsoft.com left intact
Kernel-Mode Code Signing Walkthrough / http://msdn.microsoft.com/en-us/library/windows/hardware/dn653569

fetched from http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/KMCS_Walkthrough.doc

Last updated: July 25, 2007

Applies to: Windows 2000 and later versions of Windows

Kernel-mode software must be digitally signed to be loaded on x64-based versions of Windows Vista and later versions of the Windows family of operating systems. In
addition, content protection policies for next-generation premium content might require signed kernel-mode software for certain configurations of x86-based systems.
This paper provides a beginning-to-end walkthrough of how to digitally sign both test and release versions of kernel-mode software.

File name: KMCS_Walkthrough.doc
reorg files
microsoft driver trust chain for comodo

jpyeron@black /projects/cipherShed/doc/trust/id
$ openssl verify -verbose -CAfile m/i/microsoft/MicrosoftCodeVerifRoot.crt c/o/comodo/comodorsacertificationauthority_kmod.crt
c/o/comodo/comodorsacertificationauthority_kmod.crt: OK
microsoft driver trust chain for comodo - part 2

jpyeron@black /projects/cipherShed/doc/trust/id
$ cat m/i/microsoft/MicrosoftCodeVerifRoot.crt c/o/comodo/comodorsacertificationauthority_kmod.crt | openssl verify -verbose -CAfile /dev/fd/0 c/o/comodo/COMODO.RSA.Code.Signing.CA.crt
c/o/comodo/COMODO.RSA.Code.Signing.CA.crt: OK
my code signing cert with Microsoft driver CA tracability

jpyeron@black /projects/cipherShed/doc/trust/id
$ cat m/i/microsoft/MicrosoftCodeVerifRoot.crt c/o/comodo/comodorsacertificationauthority_kmod.crt c/o/comodo/COMODO.RSA.Code.Signing.CA.crt | openssl verify -verbose -CAfile /dev/fd/0 p/y/pyeron,jason/pyeron-ciphershed-codesign-comodo.crt
p/y/pyeron,jason/pyeron-ciphershed-codesign-comodo.crt: OK