I need to start signing my PowerShell scripts, but certificates and PKI are pretty confusing to me. I'm looking for a straightforward setup guide and a practical command or workflow for signing scripts, preferably with timestamping and guidance on choosing the right certificate.
4 Answers
If your organization has an Active Directory PKI, an administrator may be able to issue a code-signing certificate internally. Otherwise, purchase one from a well-established certificate provider. It’s also worth learning the basics of PKI, since the same concepts come up with server certificates, encryption, and trust chains.
Signing is especially useful when your security controls allow only trusted or approved scripts to run, such as a deny-by-default application control policy. It also provides a way to detect whether a script was modified after signing. Keep the private key carefully protected and restrict who can use it.
If you aren’t enforcing signatures through application-control policies, signing alone won’t prevent execution of unsigned scripts. It still helps verify integrity, but the security benefit depends on how execution policies are configured.
Get a code-signing certificate from your organization’s internal certificate authority, or from a reputable commercial provider. Once it’s installed in your current user certificate store, you can sign a script with something like:
$File = "C:PathToScript.ps1"
Set-AuthenticodeSignature -FilePath $File -Certificate (Get-ChildItem Cert:CurrentUserMy -CodeSigningCert | Sort-Object NotAfter -Descending | Select-Object -First 1) -TimestampServer "https://your-timestamp-server.example"
Wrapping that command in a profile function makes repeated signing much easier.
For larger projects, it can be useful to select the signing tool based on the file extension and support recursively signing a directory. Also be careful with smart cards that require a PIN for every operation, since bulk signing can become tedious. SHA-256 is generally a sensible option as well.
The overall process is: obtain or issue a code-signing certificate, install it in the appropriate certificate store, verify that PowerShell can see it, and then use Set-AuthenticodeSignature. Always include a trusted timestamp server. Without a timestamp, a signature may stop being considered valid when the certificate expires; with one, it can remain valid if the certificate was valid when the file was signed.
For frequent use, a shortcut or editor command that signs the currently open script can make the process much less annoying.