Support non-vital certificate installs
Rob Mensching committed
Apr 11, 2021 at 14:41 UTC
3e8b7eb4cb739be1881c621999616bc5bbbb0bdb
4 files changed
+48
-7
src/ca/scacert.cpp
+4
-1
@@ -244,7 +244,7 @@ static HRESULT ConfigureCertificates(
244
ExitOnFailure(hr, "Failed to pass Certificate.Certificate to deferred CustomAction.");
245
hr = WcaWriteStringToCaData(pwzStoreName, &pwzCaData);
246
ExitOnFailure(hr, "Failed to pass Certificate.StoreName to deferred CustomAction.");
247
- hr = WcaWriteIntegerToCaData(SCA_CERT_ATTRIBUTE_BINARYDATA, &pwzCaData);
247
+ hr = WcaWriteIntegerToCaData(dwAttributes, &pwzCaData);
248
ExitOnFailure(hr, "Failed to pass Certificate.Attributes to deferred CustomAction.");
249
250
// Copy the rollback data from the deferred data because it's the same up to this point.
@@ -268,6 +268,9 @@ static HRESULT ConfigureCertificates(
268
269
hr = WcaWriteStringToCaData(pwzPFXPassword, &pwzRollbackCaData);
270
ExitOnFailure(hr, "Failed to pass Certificate.PFXPassword to rollback CustomAction.");
271
+
272
+ hr = WcaWriteIntegerToCaData(dwAttributes, &pwzCaData);
273
+ ExitOnFailure(hr, "Failed to pass Certificate.Attributes to deferred CustomAction.");
274
}
275
276
// Pick the right action to run based on what store we're uninstalling from.
src/ca/scacert.h
+1
@@ -11,6 +11,7 @@ enum SCA_CERT_ATTRIBUTES
11
SCA_CERT_ATTRIBUTE_REQUEST = 1,
12
SCA_CERT_ATTRIBUTE_BINARYDATA = 2,
13
SCA_CERT_ATTRIBUTE_OVERWRITE = 4,
14
+ SCA_CERT_ATTRIBUTE_VITAL = 8,
15
};
16
17
src/ca/scacertexec.cpp
+32
-5
@@ -23,6 +23,7 @@ static HRESULT InstallCertificatePackage(
23
__in LPCWSTR wzName,
24
__in_opt BYTE* rgbData,
25
__in DWORD cbData,
26
+ __in BOOL fVital,
27
__in_opt LPCWSTR wzPFXPassword
28
);
29
@@ -32,6 +33,12 @@ static HRESULT UninstallCertificatePackage(
33
__in LPCWSTR wzName
34
);
35
36
+static HRESULT AddCertificate(
37
+ __in HCERTSTORE hStore,
38
+ __in PCCERT_CONTEXT pCertContext,
39
+ __in LPCWSTR wzCertificateUniqueName,
40
+ __in BOOL fVital
41
+);
42
43
/* ****************************************************************
44
AddUserCertificate - CUSTOM ACTION ENTRY POINT for adding per-user
@@ -185,7 +192,7 @@ static HRESULT ExecuteCertificateOperation(
192
// CertAddCertificateContextToStore(CERT_STORE_ADD_REPLACE_EXISTING) does not remove the private key if the cert is replaced
193
UninstallCertificatePackage(hCertStore, fUserStoreLocation, pwzName);
194
188
- hr = InstallCertificatePackage(hCertStore, fUserStoreLocation, pwzName, pbData, cbData, pwzPFXPassword);
195
+ hr = InstallCertificatePackage(hCertStore, fUserStoreLocation, pwzName, pbData, cbData, iAttributes & SCA_CERT_ATTRIBUTE_VITAL, pwzPFXPassword);
196
ExitOnFailure(hr, "Failed to install certificate.");
197
}
198
else
@@ -226,6 +233,7 @@ static HRESULT InstallCertificatePackage(
233
__in LPCWSTR wzName,
234
__in_opt BYTE* rgbData,
235
__in DWORD cbData,
236
+ __in BOOL fVital,
237
__in_opt LPCWSTR wzPFXPassword
238
)
239
{
@@ -273,8 +281,7 @@ static HRESULT InstallCertificatePackage(
281
pCertContext;
282
pCertContext = ::CertEnumCertificatesInStore(hPfxCertStore, pCertContext))
283
{
276
- WcaLog(LOGMSG_STANDARD, "Adding certificate: %ls", pwzUniqueName);
277
- hr = CertInstallSingleCertificate(hStore, pCertContext, pwzUniqueName);
284
+ hr = AddCertificate(hStore, pCertContext, pwzUniqueName, fVital);
285
MessageExitOnFailure(hr, msierrCERTFailedAdd, "Failed to add certificate to the store.");
286
287
hr = StrAllocFormatted(&pwzUniqueName, L"%s_wixCert_%d", wzName, ++iUniqueId);
@@ -289,8 +296,7 @@ static HRESULT InstallCertificatePackage(
296
}
297
else
298
{
292
- WcaLog(LOGMSG_STANDARD, "Adding certificate: %ls", pwzUniqueName);
293
- hr = CertInstallSingleCertificate(hStore, pCertContext, pwzUniqueName);
299
+ hr = AddCertificate(hStore, pCertContext, pwzUniqueName, fVital);
300
MessageExitOnFailure(hr, msierrCERTFailedAdd, "Failed to add certificate to the store.");
301
}
302
@@ -402,3 +408,24 @@ LExit:
408
409
return hr;
410
}
411
+
412
+static HRESULT AddCertificate(
413
+ __in HCERTSTORE hStore,
414
+ __in PCCERT_CONTEXT pCertContext,
415
+ __in LPCWSTR wzCertificateUniqueName,
416
+ __in BOOL fVital
417
+)
418
+{
419
+ HRESULT hr = S_OK;
420
+
421
+ WcaLog(LOGMSG_STANDARD, "Adding certificate: %ls", wzCertificateUniqueName);
422
+
423
+ hr = CertInstallSingleCertificate(hStore, pCertContext, wzCertificateUniqueName);
424
+ if (FAILED(hr) && !fVital)
425
+ {
426
+ WcaLog(LOGMSG_STANDARD, "Could not add non-vital certificate: %ls due to error: 0x%x, continuing...", wzCertificateUniqueName, hr);
427
+ hr = S_FALSE;
428
+ }
429
+
430
+ return hr;
431
+}
src/wixext/IIsCompiler.cs
+11
-1
@@ -140,7 +140,7 @@ namespace WixToolset.Iis
140
{
141
var sourceLineNumbers = this.ParseHelper.GetSourceLineNumbers(element);
142
Identifier id = null;
143
- int attributes = 0;
143
+ int attributes = 8; // SCA_CERT_ATTRIBUTE_VITAL
144
string binaryRef = null;
145
string certificatePath = null;
146
string name = null;
@@ -244,6 +244,16 @@ namespace WixToolset.Iis
244
}
245
}
246
break;
247
+ case "Vital":
248
+ if (YesNoType.Yes == this.ParseHelper.GetAttributeYesNoValue(sourceLineNumbers, attrib))
249
+ {
250
+ attributes |= 8; // SCA_CERT_ATTRIBUTE_VITAL
251
+ }
252
+ else
253
+ {
254
+ attributes &= ~8; // SCA_CERT_ATTRIBUTE_VITAL
255
+ }
256
+ break;
257
default:
258
this.ParseHelper.UnexpectedAttribute(element, attrib);
259
break;