Code signing in PowerShell - Deep Dive

Overview - Code signing

What is it?

Code signing is a way to add a digital signature to scripts or software. This signature proves the code comes from a trusted source and has not been changed. It uses special certificates to create this proof. When you run signed code, your system can check if it is safe.

Why it matters

Without code signing, anyone could change or fake scripts, causing security risks like viruses or data theft. Code signing helps users trust the code they run and protects developers' work from tampering. It makes software safer and helps prevent harmful attacks.

Where it fits

Before learning code signing, you should understand basic scripting and certificates. After this, you can learn about secure script execution policies and advanced certificate management. Code signing fits into the security part of scripting and automation.

Mental Model

Core Idea

Code signing is like sealing a letter with a unique wax stamp that proves who sent it and that it wasn’t opened or changed.

Think of it like...

Imagine sending a letter sealed with a special wax stamp only you have. The receiver checks the stamp to be sure the letter is really from you and hasn’t been opened or altered. Code signing works the same way for scripts and software.

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│  Developer's  │  signs│  Script/Code  │  sends│  User/System  │
│  Private Key  │──────▶│  with Digital │──────▶│  Verifies     │
│               │       │  Signature    │       │  Signature    │
└───────────────┘       └───────────────┘       └───────────────┘

Build-Up - 7 Steps

1

Foundation

What is code signing

Concept: Introduction to the basic idea of code signing and digital signatures.

Code signing means adding a special digital signature to your script or program. This signature is created using a secret key only the developer has. It proves the code is authentic and unchanged. Think of it as a digital seal of approval.

Result

You understand that code signing adds proof of origin and integrity to code.

Understanding that code signing is about trust and protection helps you see why it is important for safe scripting.

2

Foundation

How certificates work

Concept: Basics of certificates and keys used in code signing.

Certificates are digital ID cards issued by trusted authorities. They contain a public key and information about the owner. The developer uses a private key to sign code, and others use the public key in the certificate to verify it. Certificates link identity to keys.

Result

You know that certificates connect a developer’s identity to their signing key.

Knowing certificates are like digital ID cards clarifies how systems trust signed code.

3

Intermediate

Signing scripts with PowerShell

🤔Before reading on: do you think signing a script changes its content or just adds a signature? Commit to your answer.

Concept: How to use PowerShell commands to sign scripts with a certificate.

In PowerShell, you use the Set-AuthenticodeSignature command to sign a script file. You need a code signing certificate installed on your system. The command adds a signature block to the script without changing its code. Example: $cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object { $_.Subject -like '*YourName*' } Set-AuthenticodeSignature -FilePath .\script.ps1 -Certificate $cert

Result

The script file now contains a digital signature that can be verified before running.

Understanding that signing adds a signature block without altering code helps avoid confusion about script integrity.

4

Intermediate

Verifying signed scripts

🤔Before reading on: do you think verification checks the code content or just the signature? Commit to your answer.

Concept: How PowerShell checks if a script’s signature is valid and trusted.

PowerShell uses Get-AuthenticodeSignature to check a script’s signature. It reports if the signature is valid, invalid, or missing. It also checks if the certificate is trusted and not expired. Example: Get-AuthenticodeSignature -FilePath .\script.ps1 This helps decide if the script is safe to run.

Result

You can confirm if a script is signed and if the signature is trustworthy.

Knowing verification checks both signature and certificate trust prevents running unsafe scripts.

5

Intermediate

Execution policies and signing

🤔Before reading on: do you think PowerShell always runs unsigned scripts? Commit to your answer.

Concept: How PowerShell’s execution policies use code signing to control script running.

PowerShell has execution policies like Restricted, RemoteSigned, and AllSigned. For example, RemoteSigned requires scripts from the internet to be signed. AllSigned requires all scripts to be signed. This policy helps prevent running untrusted code. You can check policy with Get-ExecutionPolicy.

Result

You understand how signing interacts with system settings to protect script execution.

Understanding execution policies shows how code signing fits into overall script security.

6

Advanced

Creating your own code signing certificate

🤔Before reading on: do you think you must buy a certificate to sign code? Commit to your answer.

Concept: How to create a self-signed code signing certificate for testing or internal use.

You can create a self-signed certificate using PowerShell’s New-SelfSignedCertificate command. This is useful for testing or internal scripts. Example: New-SelfSignedCertificate -Type CodeSigning -Subject 'CN=MyTestCert' -CertStoreLocation Cert:\CurrentUser\My Note: Self-signed certificates are not trusted by others by default.

Result

You can sign scripts without buying a certificate, but trust is limited.

Knowing how to create self-signed certificates empowers testing and internal automation.

7

Expert

Handling certificate trust and revocation

🤔Before reading on: do you think a valid signature always means safe code? Commit to your answer.

Concept: Understanding how trust chains and certificate revocation affect code signing security.

A signature is only as trusted as the certificate chain. Certificates link to trusted root authorities. If a certificate is revoked (e.g., compromised), the signature should be rejected. PowerShell checks revocation lists and trust chains during verification. Managing this is critical in production environments.

Result

You grasp that code signing security depends on certificate trust and revocation status, not just signature presence.

Understanding trust chains and revocation prevents false security assumptions and protects against compromised certificates.

Under the Hood

Code signing uses asymmetric cryptography. The developer’s private key creates a unique digital signature from the script’s content. This signature is attached to the script. When verifying, the system uses the public key from the certificate to decrypt the signature and compare it to the script’s current content hash. If they match, the code is unchanged and from the signer.

Why designed this way?

Asymmetric cryptography allows anyone to verify a signature without exposing the private key, ensuring security. Certificates issued by trusted authorities link keys to real identities, building trust. This design balances security, trust, and usability better than symmetric methods or no signing.

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│  Script File  │──────▶│  Hash Created │──────▶│  Private Key  │
│  Content      │       │  (Digest)     │       │  Signs Hash   │
└───────────────┘       └───────────────┘       └───────────────┘
        │                                         │
        │                                         ▼
        │                               ┌───────────────────┐
        │                               │  Digital Signature │
        │                               └───────────────────┘
        │                                         │
        ▼                                         ▼
┌───────────────────┐                   ┌───────────────────┐
│ Signed Script     │◀──────────────────│  Verification     │
│ (Script + Sig)    │                   │  Public Key       │
└───────────────────┘                   └───────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does a valid signature guarantee the code is safe? Commit to yes or no.

Common Belief: If a script has a valid signature, it must be safe to run.

Reality: A valid signature only proves the code is from the signer and unchanged, not that it is safe or free from bugs or malicious intent.

Why it matters: Blindly trusting signatures can lead to running harmful code from trusted but compromised or careless developers.

Quick: Can you sign a script without a certificate? Commit to yes or no.

Common Belief: You can sign scripts without any certificate or special keys.

Reality: Code signing requires a certificate with a private key; without it, you cannot create a valid digital signature.

Why it matters: Trying to sign without a certificate wastes time and causes errors.

Quick: Does signing a script change its behavior? Commit to yes or no.

Common Belief: Signing a script changes how the script runs or its code.

Reality: Signing only adds a signature block; the script’s code and behavior remain unchanged.

Why it matters: Misunderstanding this can cause confusion about script errors or behavior after signing.

Quick: Is a self-signed certificate trusted by default? Commit to yes or no.

Common Belief: Self-signed certificates are trusted the same as certificates from authorities.

Reality: Self-signed certificates are not trusted by default and require manual trust configuration.

Why it matters: Assuming trust causes scripts to fail verification or users to ignore warnings.

Expert Zone

1

Code signing timestamps can prove when code was signed, allowing signatures to remain valid even after certificate expiration.

2

Multiple signatures can be added to a single script to represent different signers or stages of approval.

3

Certificate revocation checking can be bypassed in some environments, which may weaken security if not managed properly.

When NOT to use

Code signing is not suitable for scripts that change frequently or are for quick testing; in such cases, using execution policies or sandboxing is better. Also, for internal automation without external distribution, simpler trust models may suffice.

Production Patterns

In production, code signing is combined with strict execution policies, automated certificate management, and continuous integration pipelines that sign code automatically before deployment.

Connections

Public Key Infrastructure (PKI)

Code signing builds on PKI concepts of certificates and asymmetric keys.

Understanding PKI helps grasp how trust chains and certificate authorities support code signing security.

Software Supply Chain Security

Code signing is a key part of securing the software supply chain by verifying code origin and integrity.

Knowing code signing’s role in supply chain security helps prevent attacks like tampering or injecting malicious code.

Legal Document Signing

Both use digital signatures to prove authenticity and prevent tampering.

Recognizing the similarity to legal document signing clarifies why digital signatures are trusted and legally binding.

Common Pitfalls

#1 Trying to run unsigned scripts when execution policy requires signed scripts.

Wrong approach:

Set-ExecutionPolicy RemoteSigned
.script.ps1 # script is unsigned, so blocked

Correct approach:

Set-ExecutionPolicy RemoteSigned
Set-AuthenticodeSignature -FilePath .\script.ps1 -Certificate $cert
.script.ps1 # script runs because it is signed

Root cause:

Not understanding how execution policies enforce signature requirements causes script blocking.

#2 Using an expired or revoked certificate to sign code.

Wrong approach:

Set-AuthenticodeSignature -FilePath .\script.ps1 -Certificate $expiredCert

Correct approach:

Use a valid, current certificate:
Set-AuthenticodeSignature -FilePath .\script.ps1 -Certificate $validCert

Root cause:

Ignoring certificate validity periods or revocation status leads to invalid signatures.

#3 Assuming self-signed certificates are trusted by others without configuration.

Wrong approach:

New-SelfSignedCertificate -Type CodeSigning -Subject 'CN=Test'
Set-AuthenticodeSignature -FilePath .\script.ps1 -Certificate $selfSignedCert
# Others try to run script but get trust errors

Correct approach:

Distribute and install the self-signed certificate in trusted stores on target machines before running signed scripts.

Root cause:

Not realizing trust must be manually established for self-signed certificates.

Key Takeaways

Code signing adds a digital signature to scripts to prove who created them and that they haven’t been changed.

It relies on certificates and asymmetric cryptography to create and verify signatures securely.

PowerShell provides commands to sign and verify scripts, integrating with execution policies for security.

A valid signature does not guarantee safety; trust depends on certificate validity and revocation checks.

Understanding certificate trust and management is essential for effective and secure code signing in production.