I applaud the people and companies that are signing your PowerShell scripts with certificates. For those of you who have not started signing your PowerShell scripts, it’s time to start. and the good news, it is very easy to do!

Quick overview of tasks

First thing is to ensure that you have an Internal Certificate of Authority server. Once you find that, you need to add the “Code Signing Template” to the list of available certificates. Once that’s done, install a personal certificate for your user and then sign your scripts.

Now, let’s look at the details of making that happen.

Start by going to your Certification Authority console and creating a new “Certificate Template to Issue”.

Then select the “Code Signing” Template and click “OK”.

Once that has been completed, you will see that certificate in the list of certificate templates. That is all you need to do on the CA console.

After that, open a MMC and add the “Certificates” snap-in.

After selecting the “Certficaites” snap-in and clicking  “OK”, you will be prompted for what to manage, select your user account and then click “Finish”.

Navigate to your Personal Certificate and in the open area, right click and choose to “Request New Certificate…”

After a few screen of “Next” “Next”, you will see a list of certificates to add, click the “Code Signing” certificate” and then click “Enroll”.

Once that is completed, you will see your code signing certificate in the Personal Store.

Now, we can sign a script with our SSL certificate.

 

For this, you can run just 3 PowerShell commands to sign your scripts, and yes, we can simplify to a single line, but using three to keep things simple to read.

Let’s start with a very simple script

Then you can run the following PowerShell Code to sign your script.

# Let's get the local user code signing certificate into a variable.
$cert=(dir cert:currentuser\my\ -CodeSigningCert)
# This is the file that we want to sign. Change to the file name you want to sign.
$path = 'C:\Scripts\MyCoolScript.ps1'
# this next line will sign the script. It is using the two variables we used earlier.
Set-AuthenticodeSignature -Certificate $cert -FilePath $path -TimestampServer http://timestamp.comodoca.com/authenticode

So once you re-open your script, you see a signature block at the end of your script.

And voila you have a signed script.

Using those commands, you can create a function to pass in a variable for the name of the file you want to sign, making it easier to sign in the future. Now start signing your company scripts.