topic Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail in Microsoft Virtualization Discussions

Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

KevinMDavis — Tue, 15 Oct 2024 19:53:08 GMT

We are moving a Workday environment and it's dependent upon using the PSTK commandlets for all user provisioning, onboarding and offboarding. PS v. 5.1, PSTK 9.13.1.
We cannot install any version without hitting the same error. It appears all the PSTK downloads are shipping with expired certs. The certs expired 2 days ago on 10/13:

PS C:\Windows\system32> install-module Netapp.Ontap -force -scope AllUsers

PackageManagement\Install-Package : The module 'NetApp.ONTAP' cannot be installed or updated because the authenticode

signature of the file 'NetApp.ONTAP.psd1' is not valid.

At C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1809 char:21

+ ... $null = PackageManagement\Install-Package @PSBoundParameters

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidOperation: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package],

Exception

+ FullyQualifiedErrorId : InvalidAuthenticodeSignature,ValidateAndGet-AuthenticodeSignature,Microsoft.PowerShell.P

ackageManagement.Cmdlets.InstallPackage

Failed to install or import required PSModules The following error occurred while loading the extended type data file: , C:\Program Files (x86)\WindowsPowerShell\Modules\NetApp.ONTAP\9.13.1.2306\DataONTAP.Type.ps1xml: The file was skipped because of the following validation exception: File C:\Program Files (x86)\WindowsPowerShell\Modules\NetApp.ONTAP\9.13.1.2306\DataONTAP.Type.ps1xml cannot be loaded. A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file..

, C:\Program Files (x86)\WindowsPowerShell\Modules\NetApp.ONTAP\9.13.1.2306\DataONTAP.C.Type.ps1xml: The file was skipped because of the following validation exception: File C:\Program Files (x86)\WindowsPowerShell\Modules\NetApp.ONTAP\9.13.1.2306\DataONTAP.C.Type.ps1xml cannot be loaded. A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file..

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

KevinMDavis — Tue, 15 Oct 2024 20:09:23 GMT

Really, it appears that the developers here have missed the expiry on these certs, and need to issue new ones that need to be part of all the version downloads. It's hard to imagine that we're the only environment enforcing code-signing.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

psx — Wed, 16 Oct 2024 07:39:33 GMT

You are not.

A customer of mine is facing the same...er...challenge.

Please open a case, I will let them do the same.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

psx — Wed, 16 Oct 2024 11:14:41 GMT

Rumor has it, that NetApp is aware of the issue and are actively working on a resolution.
As a workaround please download the PSTK from the support page (<https://mysupport.netapp.com/site/tools/tool-eula/ontap-powershell-toolkit>), don't use the MS PowerShell gallery version.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

KevinMDavis — Wed, 16 Oct 2024 12:47:38 GMT

Thanks, psx.

But, we had already tried the version from the support page in addition to the PowerShell Gallery version. Tried 9.15 as well....
We'll await notification from the devs that this is done. But man, if they're going to let these expire, releasing current code with a cert expiration that's looming is a big miss on their part, QA-wise.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

psx — Wed, 16 Oct 2024 12:52:10 GMT

Hi Kevin,

just back from testing the support page version, and you are correct, of course. The certificate is the same expired one.

Let's hope for a quick fix.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

WhollyJoe — Wed, 16 Oct 2024 12:58:01 GMT

I agree that one can 'get' the PSTK files from the support site, but alas, as of now it is still signed using the cert that expired on 10/13/2024.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

brnosanse — Wed, 16 Oct 2024 16:53:13 GMT

Spent half day to figure this out... Just to find your discussion... I mean, everything is so "secure" these days, that everyone has to waste time on totally useless troubleshooting.
Corporate like Netapp should do better than this.
Not to mention that I really fear what will happen after the powershell is discontinued, I have thousands of lines of automation, hope for some good AI to "translate" by that time 😄
It is disaster that it will not work the same anymore...

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

KevinMDavis — Wed, 16 Oct 2024 17:01:42 GMT

I hear you. I can't imagine (ok, I can), that NetApp would simply shelve and stop maintaining the PSTK. At the least, I would hope they'd totally open-source it so it could maintained by the "community". As it is they've abdicated supporting it to the community, so they really ought to hand over the whole thing. Good luck on the AI solution; I can only speak for ChatGPT, which I spend more time correcting and teaching it then it does providing me with usable code.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

AndrewPDX — Wed, 16 Oct 2024 18:53:33 GMT

Running into this issue as well, glad I found this thread before continuing to bang my head on our modules trying to figure out why they weren't working. Subscribed in the hopes that they push out a fix soon..

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

KevinMDavis — Wed, 16 Oct 2024 19:28:42 GMT

We opened a support case yesterday, and escalated it today (because, surprise surprise, despite it being a P2 by 13:45 ET today we'd rec'd zero response). After escalation, we were told the PSTK development team was made aware and it had eyes on it.

Given that this is essentially and easy fix (generate a new cert; sign the code with it; upload the new versions to the Support Site and PowerShell Gallery), we expect tomorrow. 🤞

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

AndrewPDX — Wed, 16 Oct 2024 19:47:02 GMT

Great to hear! Thanks for jumping on this, fingers crossed for an update tomorrow.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

Sanaman — Thu, 17 Oct 2024 02:19:25 GMT

This is for my information only.

I am running PS 7.4.5 and I don't have any issues installing PSTK 9.13.1.2306. In fact, I am running PSTK more then 2months now. What is the cert issue?

Scripts> get-natoolkitversion

Major Minor Build Revision
----- ----- ----- --------
9 13 1 2306

Thanks

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

saharsh — Thu, 17 Oct 2024 07:47:11 GMT

The certificates for PSTK are currently being renewed in preparation for the upcoming 9.16.1 release.

We are actively working on a resolution.

As workaround please PowerShell in administrator mode and execute the command `Set-ExecutionPolicy Unrestricted` to allow the package to run without errors.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

saharsh — Thu, 17 Oct 2024 22:59:03 GMT

Hi Team,
The certificate on Toolchest has been renewed, and the toolkit is now functioning properly. We kindly invite you to download it from the link below.

https://mysupport.netapp.com/site/tools/tool-eula/ontap-powershell-toolkit/download

Additionally, we will be addressing this issue on the PowerShell Gallery as well.

Thank you for your understanding.

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

brnosanse — Fri, 18 Oct 2024 06:48:50 GMT

Hello, is there a way to download old version - 9.10.1.2111?

I need old version because it is last version which working with my scripts since Netapp (to my annoyance) changed commands and many does not work without some special switches such as -ONTAPI or -ZAPICALL or such (I don’t remember exactly).

I have thousands of lines of automation which I will be throwing out later (probably resigning my position also, because without this automation I am unable to manage 150+ systems)

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

MartinKøhrsen — Fri, 18 Oct 2024 07:53:27 GMT

When can we expect powershell gallery to be updated ?

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

MartinKøhrsen — Fri, 18 Oct 2024 08:07:44 GMT

Additionally, i would not consider this issue "fixed", when the public powershell gallery download part is not yet fixed...

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

saharsh — Fri, 18 Oct 2024 09:41:59 GMT

Hi,

It is fixed on PowerShell Gallery too

https://www.powershellgallery.com/packages/NetApp.ONTAP/9.15.1.2410

Re: Expired certificates causing NetApp.ONTAP PSTK 9.13.1 install to fail

saharsh — Fri, 18 Oct 2024 09:43:41 GMT

Now it is available on PowerShell toolkit also
https://www.powershellgallery.com/packages/NetApp.ONTAP/9.15.1.2410