Index: /trunk/Config.kmk
===================================================================
--- /trunk/Config.kmk	(revision 54045)
+++ /trunk/Config.kmk	(revision 54046)
@@ -2870,4 +2870,10 @@
   VBOX_SIGNING_MODE :=
  endif
+
+#
+# Warn about windows hardening without code signing enabled.
+#
+else if "$(KBUILD_TARGET)" == "win" && defined(VBOX_WITH_HARDENING) && !defined(VBOX_ONLY_BUILD)
+ $(warning You need to enable code signing for a hardened windows build to work.)
 endif
 
Index: /trunk/src/VBox/HostDrivers/Support/Makefile.kmk
===================================================================
--- /trunk/src/VBox/HostDrivers/Support/Makefile.kmk	(revision 54045)
+++ /trunk/src/VBox/HostDrivers/Support/Makefile.kmk	(revision 54046)
@@ -119,5 +119,5 @@
 		"$@")
 # The build certificate.
-if "$(KBUILD_TARGET)" == "win" && defined(VBOX_WITH_HARDENING)
+if "$(KBUILD_TARGET)" == "win" && defined(VBOX_WITH_HARDENING) && defined(VBOX_SIGNING_MODE)
 	$(VBOX_RTSIGNTOOL) extract-exe-signer-cert --exe $(VBOX_RTSIGNTOOL) --output "$@.cer" --der
 	$(VBOX_BIN2C) -ascii --append SUPBuildCert "$@.cer" $@