Code signing in PowerShell - Mini Project: Build & Apply

Code Signing with PowerShell

📖 Scenario: You are a system administrator who needs to ensure that PowerShell scripts are trusted and have not been tampered with. To do this, you will sign a script file using a code signing certificate.

🎯 Goal: Learn how to create a simple PowerShell script, specify the path to a code signing certificate, sign the script using that certificate, and verify the signature.

📋 What You'll Learn

Create a PowerShell script file with a simple command

Specify the path to a code signing certificate file

Use the Set-AuthenticodeSignature cmdlet to sign the script

Verify the signature using Get-AuthenticodeSignature

Print the signature status

💡 Why This Matters

🌍 Real World

Code signing helps ensure scripts are trusted and not altered, which is important in secure environments.

💼 Career

System administrators and security professionals use code signing to protect scripts and software from tampering.

1

Create a simple PowerShell script file

Create a file called TestScript.ps1 with the exact content Write-Output "Hello, signed script!".

PowerShell

# Create the file TestScript.ps1 with the specified content
# Your code here

Hint

Use Set-Content to create the file with the exact text inside.

2

Specify the path to the code signing certificate

Create a variable called $certPath and set it to the string "C:\Certs\MyCodeSigningCert.pfx".

PowerShell

Set-Content -Path TestScript.ps1 -Value 'Write-Output "Hello, signed script!"'
# Create the variable $certPath with the certificate path
# Your code here

Hint

Use double backslashes \\ in the path string.

3

Sign the script using the certificate

Use Get-PfxCertificate with $certPath to get the certificate and store it in $cert. Then use Set-AuthenticodeSignature with TestScript.ps1 and $cert to sign the script. Store the result in $signature.

PowerShell

Set-Content -Path TestScript.ps1 -Value 'Write-Output "Hello, signed script!"'
$certPath = "C:\Certs\MyCodeSigningCert.pfx"
# Get the certificate and sign the script
# Your code here

Hint

Use Get-PfxCertificate to load the certificate, then Set-AuthenticodeSignature to sign the script.

4

Verify and print the signature status

Use Get-AuthenticodeSignature on TestScript.ps1 and store the result in $verify. Then print the Status property of $verify using Write-Output.

PowerShell

Set-Content -Path TestScript.ps1 -Value 'Write-Output "Hello, signed script!"'
$certPath = "C:\Certs\MyCodeSigningCert.pfx"
$cert = Get-PfxCertificate -FilePath $certPath
$signature = Set-AuthenticodeSignature -FilePath TestScript.ps1 -Certificate $cert
# Verify the signature and print the status
# Your code here

Hint

The output should be Valid if the script is signed correctly.

Practice

1. What is the main purpose of code signing a PowerShell script?

easy

A. To prove the script is from a trusted source and has not been altered

B. To make the script run faster

C. To encrypt the script content

D. To convert the script into an executable file

Solution

1. Step 1: Understand code signing purpose

   Code signing is used to verify the identity of the script author and ensure the script has not been changed.

2. Step 2: Compare options

   Only To prove the script is from a trusted source and has not been altered describes this purpose correctly. Other options describe unrelated actions like encryption or performance.

3. Final Answer:

   To prove the script is from a trusted source and has not been altered -> Option A

4. Quick Check:

   Code signing = prove trust and integrity [OK]

Hint: Code signing proves trust and no changes [OK]

Common Mistakes:

• Thinking code signing encrypts the script
• Believing code signing speeds up execution
• Confusing code signing with file conversion

2. Which PowerShell command is used to sign a script with a certificate?

easy

A. New-ScriptSignature

B. Sign-ScriptCertificate

C. Set-AuthenticodeSignature

D. Add-ScriptCertificate

Solution

1. Step 1: Identify the correct cmdlet for signing

   The official PowerShell cmdlet to sign scripts is Set-AuthenticodeSignature.

2. Step 2: Verify other options

   Other options are not valid PowerShell commands for signing scripts.

3. Final Answer:

   Set-AuthenticodeSignature -> Option C

4. Quick Check:

   Sign script cmdlet = Set-AuthenticodeSignature [OK]

Hint: Remember: Set-AuthenticodeSignature signs scripts [OK]

Common Mistakes:

• Using non-existent cmdlets like Sign-ScriptCertificate
• Confusing signing with creating certificates
• Misspelling the cmdlet name

3. What will be the output of this PowerShell command if the script is successfully signed?

Set-AuthenticodeSignature -FilePath 'script.ps1' -Certificate $cert

medium

A. The script file is deleted

B. An error message about missing parameters

C. No output is shown

D. A Signature object showing Status as Valid

Solution

1. Step 1: Understand Set-AuthenticodeSignature output

   This cmdlet returns a Signature object with a Status property indicating if signing succeeded.

2. Step 2: Interpret successful signing output

   If signing succeeds, Status will be 'Valid'. No deletion or silent output occurs.

3. Final Answer:

   A Signature object showing Status as Valid -> Option D

4. Quick Check:

   Successful signing = Status Valid output [OK]

Hint: Successful signing returns Status Valid object [OK]

Common Mistakes:

• Expecting no output after signing
• Thinking the script file is deleted
• Confusing error messages with success

4. You run this command but get an error: Set-AuthenticodeSignature : Cannot find the certificate. What is the likely cause?

medium

A. The script is already signed

B. The certificate variable is empty or invalid

C. PowerShell version is too old

D. The script file path is incorrect

Solution

1. Step 1: Analyze the error message

   The error says it cannot find the certificate, meaning the $cert variable is likely empty or invalid.

2. Step 2: Check other options

   Incorrect file path causes a different error. PowerShell version or existing signature do not cause this specific error.

3. Final Answer:

   The certificate variable is empty or invalid -> Option B

4. Quick Check:

   Certificate missing error = invalid $cert [OK]

Hint: Check certificate variable if 'Cannot find certificate' error [OK]

Common Mistakes:

• Assuming file path is the problem
• Thinking PowerShell version causes this error
• Believing script already signed causes this error

5. You want to sign multiple scripts in a folder using the same certificate. Which PowerShell snippet correctly signs all .ps1 files?

hard

A. Get-ChildItem -Path . -Filter '*.ps1' | ForEach-Object { Set-AuthenticodeSignature -FilePath $_.FullName -Certificate $cert }

B. Set-AuthenticodeSignature -FilePath '*.ps1' -Certificate $cert

C. ForEach ($file in '*.ps1') { Set-AuthenticodeSignature -FilePath $file -Certificate $cert }

D. Get-Content '*.ps1' | Set-AuthenticodeSignature -Certificate $cert

Solution

1. Step 1: Identify correct way to get all .ps1 files

   Get-ChildItem -Filter '*.ps1' lists all script files in the folder.

2. Step 2: Apply signing to each file

   Using ForEach-Object to call Set-AuthenticodeSignature on each file with the certificate is correct.

3. Step 3: Check other options

   Set-AuthenticodeSignature -FilePath '*.ps1' -Certificate $cert tries to sign a wildcard path directly (invalid). ForEach ($file in '*.ps1') { Set-AuthenticodeSignature -FilePath $file -Certificate $cert } treats '*.ps1' as a string list (wrong). Get-Content '*.ps1' | Set-AuthenticodeSignature -Certificate $cert pipes file content, not file paths (wrong).

4. Final Answer:

   Get-ChildItem -Path . -Filter '*.ps1' | ForEach-Object { Set-AuthenticodeSignature -FilePath $_.FullName -Certificate $cert } -> Option A

5. Quick Check:

   Use Get-ChildItem + ForEach-Object to sign all scripts [OK]

Hint: Use Get-ChildItem and ForEach-Object to sign multiple files [OK]

Common Mistakes:

• Trying to sign wildcard paths directly
• Using file content instead of file paths
• Treating '*.ps1' as a list of files