When setting 'ms-cert=2023' rather than 'ms-cert=2023w' on an existing EFI disk, both certificates would still be enrolled, but the 'ms-cert=2023' would end up in the VM configuration. Pick up the 'ms-cert=2023w' marker which already gets set by the OVMF::change_drive() function.
Reported-by: Daniel Kral <[email protected]> Signed-off-by: Fiona Ebner <[email protected]> --- New in v4. src/PVE/QemuServer.pm | 1 + 1 file changed, 1 insertion(+) diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm index d103731c..741b2499 100644 --- a/src/PVE/QemuServer.pm +++ b/src/PVE/QemuServer.pm @@ -4972,6 +4972,7 @@ sub vmconfig_apply_pending { $old_drive, $new_drive, ); + $conf->{pending}->{$opt} = print_drive($new_drive); } } elsif (defined($conf->{pending}->{$opt}) && $opt =~ m/^net\d+$/) { my $new_net = PVE::QemuServer::Network::parse_net($conf->{pending}->{$opt}); -- 2.47.3
