Fix cert installation to use cert from .cat file

[Nick Grifka (nigriMSFT)]

Avoid a crash in Export-Certificate if the driver does not have a signer certificate

[Michael Friesen (mtfriesen)]

Can you explain this scenario a bit more? In XDP, we eventually figured out that what we really need to install is the .cat signing cert, not the .sys cert.

[Nick Grifka (nigriMSFT)]

Can you explain this scenario a bit more? In XDP, we eventually figured out that what we really need to install is the .cat signing cert, not the .sys cert.

The .sys file from the ingested vpack is not signed. I checked and you are right though, the .cat is signed. Let me try using the .cat instead

Update:
Using the script code from XDP didn't work as-is, AI helped me fix a few problems:

1. X509Chain.Build() was passed a string instead of a certificate object (line 224). The .NET method requires an X509Certificate2 object, not a file path. Fixed by constructing the object from the file path first.
2. The file path needed to be resolved to an absolute path (line 222). The X509Certificate2 constructor doesn't understand PowerShell relative paths like .\fnmp\fnmp.cat.cer. Fixed with Resolve-Path.
3. Import-Certificate to trustedpublisher was failing with Access Denied (line 232). Even with admin privileges, Import-Certificate -CertStoreLocation was rejected for the trustedpublisher store. Fixed by using the .NET X509Store API directly to open the store and add the cert object in-memory.

[Michael Friesen (mtfriesen)]

Interesting, I haven't seen that TrustedPublisher access denied before.