Signing PowerShell Scripts
Signing your PowerShell scripts ensures their integrity and authenticity. It allows you to run scripts in environments with strict execution policies like AllSigned or RemoteSigned.
Parent Topic: PowerShell Scripting and Programming Related: Handling Secrets Securely
1. Why Sign Scripts?
- Integrity: Ensures the script hasn't been tampered with since it was signed.
- Identity: Confirms who wrote the script.
- Policy Compliance: Required for the
AllSignedexecution policy.
2. Obtaining a Code Signing Certificate
To sign a script, you need a Code Signing Certificate.
- Public CA: For scripts distributed publicly or across organizations (e.g., DigiCert, Sectigo). Trusted by default on Windows.
- Internal CA: For scripts used within a specific enterprise domain.
- Self-Signed: For local testing and development only.
3. Creating a Self-Signed Certificate (For Testing)
You can create a self-signed certificate using PowerShell.
$cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject "CN=MyPowerShellCodeSigningCert" -CertStoreLocation Cert:\CurrentUser\MyNote: Self-signed certificates are not trusted by other computers by default. You must install this certificate into the "Trusted Root Certification Authorities" and "Trusted Publishers" stores on any machine where you want to run the script.
4. Signing a Script
Once you have a certificate, use Set-AuthenticodeSignature to sign your .ps1 file.
# 1. Get the certificate
$cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
# 2. Sign the script
Set-AuthenticodeSignature -FilePath ".\MyScript.ps1" -Certificate $certIf successful, you will see a Status of Valid.
If you open MyScript.ps1, you will see a block of commented text at the bottom starting with # SIG # Begin signature block. This is the digital signature.
5. Verifying a Signature
You can check if a script is signed and valid without running it.
Get-AuthenticodeSignature -FilePath ".\MyScript.ps1"- Valid: The signature is valid and the certificate is trusted.
- UnknownError: The certificate is not trusted (common with self-signed certs).
- HashMismatch: The file content has been modified after signing.
6. Running Signed Scripts
If your execution policy is set to AllSigned, only signed scripts will run.
Set-ExecutionPolicy AllSigned -Scope CurrentUser
.\MyScript.ps1If you modify even a single character in the script after signing it, the signature breaks, and PowerShell will refuse to run it until you re-sign it.
Return to PowerShell Scripting and Programming