+++ This bug was initially created as a clone of Bug #1624313 +++
Description of problem:
Can't install virtio for network in win2008r2 and win7 guest after v2v conversion
Version-Release number of selected component (if applicable):
--- Additional comment from Yan Vugenfirer on 2018-09-03 07:20:55 EDT ---
I think it relates to the fact that now MS is issuing only SHA2 certificates and the images might not be updated to the latest security updates.
For info here:
1. Drivers for Win7 and Windows 2008R2 were signed with SHA1 signature. And those versions of Windows couldn't correctly parse SHA2 signatures.
2. MS decided that SHA1 is no longer secured and rolled out security updates. From this point drivers could be either SHA1 or SHA2 signed.
3. At some point, MS stopped issuing completely SHA1 certificates (https://support.microsoft.com/en-us/help/3123479/microsoft-security-advisory-deprecation-of-sha-1-hashing-algorithm-for)
4. Attaching signature details for Win7 x64 NetKVM driver
So the solution is to update the images to include SHA2 support.
--- Additional comment from Richard W.M. Jones on 2018-09-03 07:46:34 EDT ---
Does this mean we'll no longer be able to support Windows 7 & 2008R2?
Or did they issue updates to those versions of Windows to allow them
to support SHA2 certs?
In any case this will require some virt-v2v docs changes ...
--- Additional comment from Yan Vugenfirer on 2018-09-03 09:15:52 EDT ---
Updates are downloadable from https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2015/3033929
This bug will be fixed by the rebase scheduled for RHEL 7.7, see bug 1621895.
Verify bug with builds:
1.Install latest virt-v2v on RHEL7.7 server.
2.Open virt-v2v manual paper and search info with keyword "SHA-2"
# man virt-v2v|grep "SHA-2" -A 5
Support for SHA-2 certificates in Windows 7 and Windows Server 2008 R2
Later versions of the Windows virtio drivers are signed using SHA-2 certificates (instead of
SHA-1). The original shipping Windows 7 and Windows Server 2008 R2 did not understand SHA-2
certificates and so the Windows virtio drivers will not install properly.
To fix this you must apply SHA-2 Code Signing Support from:
converting the guest.
For further information see: https://bugzilla.redhat.com/show_bug.cgi?id=1624878
V2V man page has updated the description about "support for SHA-2 certs required for converting Windows 7 and 2008 R2 guests"