Code signing in PowerShell

Introduction

Code signing helps prove that a script or program is safe and comes from a trusted source. It stops others from changing your code without permission.

When you want to share a PowerShell script with others and ensure it is not changed.

When running scripts on a system that requires signed scripts for security.

When distributing software to customers who need to trust your code.

When automating tasks in a company that enforces script signing policies.

Syntax

PowerShell

Set-AuthenticodeSignature -FilePath <path-to-script> -Certificate <certificate-object>

You need a code signing certificate to sign scripts.

The can be obtained from your certificate store or a file.

Examples

This signs the script located at C:\Scripts\MyScript.ps1 using the certificate stored in the variable $cert.

PowerShell

Set-AuthenticodeSignature -FilePath "C:\Scripts\MyScript.ps1" -Certificate $cert

This finds a certificate with 'MyCodeSigningCert' in its subject and uses it to sign the script.

PowerShell

$cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object { $_.Subject -like "*MyCodeSigningCert*" } | Select-Object -First 1
Set-AuthenticodeSignature -FilePath "C:\Scripts\MyScript.ps1" -Certificate $cert

Sample Program

This script looks for a code signing certificate in the current user's certificate store. If it finds one, it signs the script at C:\Scripts\ExampleScript.ps1 and prints a success message. If not, it tells you no certificate was found.

PowerShell

$cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object { $_.Subject -like "*Code Signing*" } | Select-Object -First 1
if ($cert) {
    Set-AuthenticodeSignature -FilePath "C:\Scripts\ExampleScript.ps1" -Certificate $cert
    Write-Output "Script signed successfully."
} else {
    Write-Output "No suitable code signing certificate found."
}

Important Notes

You must have a valid code signing certificate installed on your computer.

Unsigned scripts may be blocked from running depending on your system's execution policy.

Always keep your private key secure to prevent misuse.

Summary

Code signing proves your script is from you and has not been changed.

Use Set-AuthenticodeSignature with a certificate to sign scripts.

Signed scripts help keep your system safe and trusted.