Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Windows] Fix access denied issue in OVS cert import #6529

Merged
merged 1 commit into from
Jul 18, 2024
Merged

[Windows] Fix access denied issue in OVS cert import #6529

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion hack/windows/Install-OVS.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,14 @@ function CheckAndInstallOVSDriver {
$ExportType = [System.Security.Cryptography.X509Certificates.X509ContentType]::Cert
$Cert = (Get-AuthenticodeSignature $DriverFile).SignerCertificate
[System.IO.File]::WriteAllBytes($CertificateFile, $Cert.Export($ExportType))
Import-Certificate -FilePath "$CertificateFile" -CertStoreLocation cert:\LocalMachine\TrustedPublisher
# Use certstore.Add to import cert into trusted publishers instead of Import-Certificate,
# otherwise an error "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"
# may occur when `Import-Certificate` is used to import a certificate to the trusted publisher
# store for the first time on a fresh Windows 2022 Node. See issue #6530.
$CertStore = Get-Item cert:\LocalMachine\TrustedPublisher
$CertStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]"ReadWrite")
$CertStore.Add($(Get-Item $CertificateFile).FullName)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Import the certificate from the file into an X509Certificate2 object and then adds that object to the store !

Suggested change
$CertStore.Add($(Get-Item $CertificateFile).FullName)
# Load the certificate from the file into an X509Certificate2 object
$certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$certificate.Import($certificateFilePath)
# Add the certificate to the store
$certStore.Add($certificate)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rajnkamr , I have verified that my solution does work. I don't think it is necessary to explicitly create a new object for the certificate, instead, when we use a file path to add into the cert store, Windows OS would load the cert automatically. My current solution (using a file path as parameter) is supported by Windows.

$CertStore.Close()
Import-Certificate -FilePath "$CertificateFile" -CertStoreLocation cert:\LocalMachine\Root

# Install the OVSext driver with the desired version
Expand Down