The process may take a few seconds, but should certainly not take minutes. At this point, a Windows confirmation dialog should pop up, asking whether you really want to install the certificate. Before anything else, please check whether that prompt may perhaps be hiding behind another window.
What is being logged in the text area (below “Installing Certificate”, above “Installing certificate with fingerprint”)? Is a fingerprint actually being shown?
No, there are no other windows or pop-ups open. I can alt-tab around and nothing else is available. Nothing else shows up in Task Manager apart from gpgol-client and a sub-process “GnuPG Outlook Add-in”. Bringing that to the front only gives the locked window.
I’m testing on Windows 11 25H2, too, but cannot reproduce the problem. Some more questions, hoping to get some clues:
Is this the first time you installed gpg4win on these machines, or could some leftovers from a previous installation interfere (in theory they should not, anyway, but…)? In File Explorer, type %userprofile%\AppData into the addressbar. Check both the Local and Roaming folders for any subfolders named gpgol-client or Gpg4Win\gpgol-client, and move those out of the way, if any.
Is this a private machine or is it administered by your company? Perhaps some specific configuration option gets in the way?
At the point where the dialog is stuck, try pressing Ctrl+Alt+Esc, and bring up the Task Manager. Do you seen any PowerShell process?
You could also try using our previous release (in the download link, substitute 5.1.0.exe for 5.0.2.exe), as we did in fact change several things in the initial setup procedure. If you can successfully generate and install the certificate with that version, you should then be able to upgrade to 5.1.0, again, without having to repeat this step.
No, there are no GpgOL folders in AppData local or roaming
Yes, it is a domain joined company administrated machine. I am a company domain administrator, I’m working on this for a user, using my non-admin rights user account.
If it were blocked by Windows Applocker policy, we would expect a large MS message saying so, and we’d see it in the event log - I’m not getting either.
I will try un-installing 5.1.0 and starting again with 5.0.2
Using 5.1.0 I did get a message when I closed the window
“The GpgOL/Web proxy process has exited. This usually indicates another application is blocking the required port, or a faulty installation” with Restart or Quit
localhost:5656. But since you were not getting this from the start, the most likely cause is that the old instance of the proxy process is still running. Look for and terminate any gpgol-server processes in the Task Manger.
Ok, glad to see some progress. Could you try the “Test Page” (Settings->Proxy & TLS->Open Test Page) to make sure the certificate actually got installed, correctly? We used to have very limited error handling in that area.
Just for larks, I re-ran the GpgOL-Web client on the laptop, v5.1.0 from the command line. This is what I got:
C:\Program Files\Gpg4win\bin>gpgol-client.exe /?
C:\Program Files\Gpg4win\bin>org.gpgol.client: Startup timing: 0 ms: Application created
org.gpgol.client: Got ElevationToken 0
org.gpgol.client: Responder handle: 0x0
org.gpgol.client: Created responder: “gpgol-clientResponder” with handle: 0xe07ec
org.gpgol.client: Startup timing: 37 ms: Service created
org.gpgol.server.http: Couldn’t open file “C:/Users/ed.morgan/AppData/Local/Gpg4win/gpgol-web/tls//certificate-key.pem” for reading: “The system cannot find the file specified.”
org.gpgol.server.http: Server failed to listen on a port.
From a Windows POV, this line should surely fail - C:/Users/ed.morgan/AppData/Local/Gpg4win/gpgol-web/tls//certificate-key.pem
Because of the // but also C:/Users/ed.morgan/AppData/Local/Gpg4win/gpgol-web/tls folder is empty.
The user profile we’re running under is the non-priv profile “ed.morgan”.
Don’t know if this helps any. If there is anything more I can do.
Thanks the additional info. Indeed I’m not yet sure, what causes the problem (other than it is one of the - rather many - things that have changed between 5.0.2 and 5.1.0).
The fact that tls/certificate-key.pem is not in place, yet, is to be expected. It does not get written to the final destination, until it has been installed in the Windows trust store (which is the step that gets stuck, somehow). After successful installation, the gpgol-server process would then be restarted.
Is %temp% set to anything unusual? While stuck at the installation step, does a file gpgpol_ca_install_done pop up in %temp%, and if so what are the contents?
Could a policy prevent gpgol-client from launching a powershell script? It does so in both 5.0.2 and 5.1.0, but in 5.0.2, it was unconditionally launching powershell via runas, whereas in 5.1.0 the (broken?) idea is to avoid runas, unless launching without fails.
%temp% is set to C:\Users\ED8F34~1.MOR\AppData\Local\Temp which is the DOS 8.3 of my name.
in there we have a gpgol-client.FMZUyk file, which is a cert:
Issuer …: /CN=GnuPG Outlook Add-in Local Root CA
Serial …: 11156124E787A1D8
Subject ..: /CN=GnuPG Outlook Add-in Local Root CA
aka ..: localroot@gpgoljs.local
Keygrip ..: CEFECBB92681D9FFDD367E7E171138FEEAF4DAEF
-----BEGIN CERTIFICATE-----
etc etc
>· Could a policy prevent gpgol-client from launching a powershell script? It does so in both 5.0.2 and 5.1.0, but in 5.0.2, it was unconditionally launching powershell via runas, whereas in 5.1.0 the (broken?) idea is to avoid runas, unless launching without fails. <
I ran up a quick test, and looks like yes:
C:\Users\ed.morgan>powershell c:\users\ed.morgan\temp\test1.ps1
c:\users\ed.morgan\temp\test1.ps1 : File C:\users\ed.morgan\temp\test1.ps1 cannot be loaded because its operation is
blocked by software restriction policies, such as those created by using Group Policy.
our execution policy is “all signed”, so the powershell script would have to be signed by a recognised cert.
Where PATH_TO_CERTFILE is the file you found in %TEMP%, and PATH_TO_PROGRESS_FILE is a textfile that the script will create to communicate success or error.
Could you confirm whether the script also gets blocked when invoked like this? Further, does it run when invoked with runas?
C:\Users\ed.morgan>powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\Gpg4Win\bin/install.ps1" CurrentUser "C:\Users\ED8F34~1.MOR\AppData\Local\Temp\gpgol-client.FMZUyk" "c:\ict\edgpg.txt"
File C:\Program Files\Gpg4Win\bin\install.ps1 cannot be loaded. The file C:\Program Files\Gpg4Win\bin\install.ps1 is
not digitally signed. You cannot run this script on the current system. For more information about running scripts and
setting execution policy, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.
+ CategoryInfo : SecurityError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : UnauthorizedAccess
And RUNAS is blocked as well:
C:\Users\ed.morgan>runas /user:scas\ed.morgan powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\Gpg4Win\bin/install.ps1" CurrentUser "C:\Users\ED8F34~1.MOR\AppData\Local\Temp\gpgol-client.FMZUyk" "c:\ict\edgpg.txt"
This program is blocked by group policy. For more information, contact your system administrator.
Only digitally signed certs are allowed by Powershell execution policy on our machines. For myself, I could sign that install.PS1 and it should run OK. Then load my locally issued code-signing cert onto the user’s machine.
Can you get a code signing cert that would have to be manually loaded on corporate machines?
Hm. Since this step worked for you with 5.0.2, invoking the script with elevated permissions must have been possible (the script was a little different, then, but it had never been signed). I guess I’ve misled you again, this time regarding runas: It’s actually ShellExecuteW with the “verb” runas. I believe the actual command line equivalent of that is:
As for loading a code-signing cert: Literally the only thing the install-script does is to install a custom CA-cert, so if all else fails (for now, I’m still optimistic), then that would be the manual step to take, directly.
“Start-process” , called from Powershell as ed.morgan (non-priv user) immediately triggers a UAC “do you want to allow this app to make changes to your device” and a demand for privileged credentials.
If I enter my admin creds, it comes up with a security warning
Windows cannot validate that the certificate is actually from “GnuPG Outlook Addin Local Root CA”
and shows the thumbprint.
If I run the script and install the cert manually as it comes up in %temp%, the add-in program still doesn’t complete, because it’s looking for the log file with “done”.
If you need someone to test installation in a restrictive corporate environment, please drop me a message.
I have yet another question: my 5.1.0 install is not happy because I used MS Entra to push the .xml file from my 5.0.2 install. Completely reasonable of it.
But the “generate a manifest file” button doesn’t create anything. I didn’t find any .xml files in the user\local folders.
The path to the .xml file gets copied to the clipboard.
Embarrassingly, I notice you will run into a further problem with that, unless upgrading from an earlier version: The directory where the file is supposed to appear may not exist. Try mkdir C:\Users\ed.morgan\AppData\Local\Gpg4win\gpgol-client before clicking the button. Will be fixed in the next release, of course.
HTTPS connectiont to GpgOL background service successful.