49 lines
2.4 KiB
PowerShell
49 lines
2.4 KiB
PowerShell
$ErrorActionPreference = 'Stop'
|
|
$certificateDirectory = Join-Path $env:LOCALAPPDATA 'SovereignAI\certs'
|
|
$expectedDirectory = [System.IO.Path]::GetFullPath($certificateDirectory).TrimEnd('\')
|
|
$knownFiles = @(
|
|
'sovereignai-local-root.pem',
|
|
'sovereignai-local-root.cer',
|
|
'sovereignai-local-root-key.pem',
|
|
'sovereignai-local-root.srl',
|
|
'localhost-cert.pem',
|
|
'localhost-cert.cer',
|
|
'localhost-key.pem',
|
|
'localhost.csr',
|
|
'localhost-extensions.cnf'
|
|
) | ForEach-Object { Join-Path $certificateDirectory $_ }
|
|
|
|
foreach ($path in $knownFiles) {
|
|
$fullPath = [System.IO.Path]::GetFullPath($path)
|
|
if (-not $fullPath.StartsWith($expectedDirectory + '\', [StringComparison]::OrdinalIgnoreCase)) {
|
|
throw "Refusing to remove a TLS file outside the dedicated certificate folder: $fullPath"
|
|
}
|
|
}
|
|
|
|
$certutil = Get-Command certutil.exe -ErrorAction SilentlyContinue
|
|
if (-not $certutil) { throw 'certutil.exe was not found; no certificates or files were changed.' }
|
|
foreach ($derFile in @(
|
|
(Join-Path $certificateDirectory 'sovereignai-local-root.cer'),
|
|
(Join-Path $certificateDirectory 'localhost-cert.cer')
|
|
)) {
|
|
if (-not (Test-Path -LiteralPath $derFile -PathType Leaf)) { continue }
|
|
$certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($derFile)
|
|
$trusted = Get-ChildItem Cert:\CurrentUser\Root | Where-Object Thumbprint -eq $certificate.Thumbprint
|
|
if ($trusted) {
|
|
& $certutil.Source -user -delstore Root $certificate.Thumbprint | Out-Null
|
|
if ($LASTEXITCODE -ne 0) { throw "certutil could not remove the exact certificate $($certificate.Thumbprint)." }
|
|
$stillTrusted = Get-ChildItem Cert:\CurrentUser\Root | Where-Object Thumbprint -eq $certificate.Thumbprint
|
|
if ($stillTrusted) { throw "Certificate $($certificate.Thumbprint) remains in CurrentUser\Root." }
|
|
Write-Host "Removed exact trusted certificate $($certificate.Thumbprint)."
|
|
}
|
|
}
|
|
|
|
foreach ($path in $knownFiles) {
|
|
if (Test-Path -LiteralPath $path -PathType Leaf) { Remove-Item -LiteralPath $path -Force }
|
|
}
|
|
if ((Test-Path -LiteralPath $certificateDirectory -PathType Container) -and
|
|
-not (Get-ChildItem -LiteralPath $certificateDirectory -Force)) {
|
|
Remove-Item -LiteralPath $certificateDirectory -Force
|
|
}
|
|
Write-Host 'Removed only the known SovereignAI local TLS files and matching trusted certificates.'
|