El Capitain: kext code signature is invalid

Hello,

We've applied for the kernel certificate in order to sign kext extensions and load them into the system - currently we're operating on El Capitan 10.11.3. We've applied the obtained certiticate to the system, which is available in the system's keychain. After that I've created a new generic kernel extension in XCode 7.3 and selected my certificate to be used for signing purposes.

After building the default simple kernel module (without modifying the code in any way), I've chowned to root:wheel and chmod to 755 in order to fix permission issues; I've also moved the certificate to /System/Library/Extensions/ directory. Afterwars, I wanted to load the kext into the kernel by using the kextload, which failed with the following error:

# kextload helloworld.kext/
/System/Library/Extensions/helloworld.kext failed to load - (libkern/kext) not loadable (reason unspecified); check the system/kernel logs for errors or try kextutil(8).

The system log reports the following:

Apr  1 10:05:00 Evangeline com.apple.kextd[45]: Untrusted kexts are not allowed
Apr  1 10:05:00 Evangeline com.apple.kextd[45]: ERROR: invalid signature for com.apple.driver.helloworld, will not load

The kextutil reports that code signature is invalid:

# kextutil -tn helloworld.kext/
helloworld.kext is invalid; can't resolve dependencies.
helloworld.kext is invalid; can't resolve dependencies.
helloworld.kext is invalid; can't resolve dependencies.
Diagnostics for helloworld.kext:
Validation Failures:
    Info dictionary property value is illegal:
        OSBundleLibraries
    Info dictionary missing required property/value:
        OSBundleLibraries
 
 
Code Signing Failure: code signature is invalid

The spctl rejects the kext:

Evangeline:Debug root# spctl -vat execute helloworld.kext
helloworld.kext: rejected

The certificate has the following extensions:

Key Usage ( 2.5.29.15 )
Basic Constraints ( 2.5.29.19 )
Extended Key Usage ( 2.5.29.37 )
Subject Key Identifier ( 2.5.29.14 )
Authority Key Identifier ( 2.5.29.35 )
Certificate Policies ( 2.5.29.32 )
( 1.2.840.113635.100.6.1.12 )
Certificate Authority Information Access ( 1.3.6.1.5.5.7.1.1 )

The certificate doesn't have the "1.2.840.113635.100.6.1.18" OID, which seems to be requred to sign kernel extensions, but I'm not sure how to proceed. The https://developer.apple.com/account/mac/certificate/ doesn't say anything about obtaining kext certificate - which we've requested in the past and it was granted to us by Apple.

Any ideas what is going on and how should we proceed?

Thank you