Code signing in PowerShell - Step-by-Step Execution

Concept Flow - Code signing

Write Script File

↓

Generate Signing Certificate

↓

Sign Script with Certificate

↓

Verify Signature

↓

Run Script

↓

Execution Allowed if Signature Valid

↓

END

This flow shows how a script is created, signed with a certificate, verified, and then allowed to run if the signature is valid.

Execution Sample

PowerShell

Set-AuthenticodeSignature -FilePath .\MyScript.ps1 -Certificate $cert
Get-AuthenticodeSignature -FilePath .\MyScript.ps1

This code signs a PowerShell script file with a certificate and then checks the signature status.

Execution Table

Step	Action	Input/Condition	Result	Output
1	Sign Script	File: MyScript.ps1, Certificate: $cert	Signature added to script	Signature.Status = Valid
2	Verify Signature	File: MyScript.ps1	Check signature validity	Signature.Status = Valid
3	Run Script	Signature.Status == Valid	Script runs successfully	Script output or actions executed
4	Run Script	Signature.Status != Valid	Script blocked or warning shown	No script execution

💡 Execution stops if signature is invalid or missing, preventing script run.

Variable Tracker

Variable	Start	After Signing	After Verification	After Run
$cert	Certificate object loaded	Certificate object loaded	Certificate object loaded	Certificate object loaded
Signature.Status	None	Valid	Valid	Valid or Invalid depending on verification
Script Execution	Not started	Not started	Ready to run	Executed or blocked

Key Moments - 3 Insights

Why does the script not run if the signature is invalid?

Because the verification step (see execution_table step 4) checks the signature status and blocks execution if it is not valid to protect from untrusted code.

What happens if you sign the script with a wrong or expired certificate?

The signature status will be invalid during verification (execution_table step 2), causing the script to be blocked at run time.

Is the certificate variable ($cert) changed after signing?

No, $cert remains the same certificate object throughout (see variable_tracker), it is used to sign but not modified.

Visual Quiz - 3 Questions

Look at the execution_table, what is the signature status immediately after signing the script?

A Valid

B Invalid

C None

D Expired

💡 Hint

Check execution_table row 1, Output column shows Signature.Status after signing.

At which step does the script get blocked if the signature is invalid?

A Step 1 - Signing

B Step 4 - Running with invalid signature

C Step 3 - Running

D Step 2 - Verification

💡 Hint

Look at execution_table row 4 where script is blocked due to invalid signature.

If the certificate variable $cert was null, what would happen during signing?

A Script signs successfully

B Signature status becomes Valid anyway

C Signing fails, no signature added

D Script runs without signature

💡 Hint

Refer to variable_tracker and execution_table step 1 where certificate is required for signing.

Concept Snapshot

Code signing in PowerShell:
- Use Set-AuthenticodeSignature with a certificate to sign scripts.
- Use Get-AuthenticodeSignature to verify signature status.
- Script runs only if signature is valid.
- Protects from running untrusted or altered scripts.
- Certificate must be valid and trusted.

Full Transcript

Code signing in PowerShell involves creating a script file, then using a certificate to sign it with the Set-AuthenticodeSignature command. This adds a digital signature to the script. Later, the signature is checked using Get-AuthenticodeSignature to confirm it is valid. If the signature is valid, the script is allowed to run safely. If invalid or missing, the script is blocked to protect the system from untrusted code. The certificate used for signing remains unchanged during this process. This ensures scripts are trusted and have not been tampered with before execution.

Practice

1. What is the main purpose of code signing a PowerShell script?

easy

A. To prove the script is from a trusted source and has not been altered

B. To make the script run faster

C. To encrypt the script content

D. To convert the script into an executable file

Solution

1. Step 1: Understand code signing purpose

   Code signing is used to verify the identity of the script author and ensure the script has not been changed.

2. Step 2: Compare options

   Only To prove the script is from a trusted source and has not been altered describes this purpose correctly. Other options describe unrelated actions like encryption or performance.

3. Final Answer:

   To prove the script is from a trusted source and has not been altered -> Option A

4. Quick Check:

   Code signing = prove trust and integrity [OK]

Hint: Code signing proves trust and no changes [OK]

Common Mistakes:

• Thinking code signing encrypts the script
• Believing code signing speeds up execution
• Confusing code signing with file conversion

2. Which PowerShell command is used to sign a script with a certificate?

easy

A. New-ScriptSignature

B. Sign-ScriptCertificate

C. Set-AuthenticodeSignature

D. Add-ScriptCertificate

Solution

1. Step 1: Identify the correct cmdlet for signing

   The official PowerShell cmdlet to sign scripts is Set-AuthenticodeSignature.

2. Step 2: Verify other options

   Other options are not valid PowerShell commands for signing scripts.

3. Final Answer:

   Set-AuthenticodeSignature -> Option C

4. Quick Check:

   Sign script cmdlet = Set-AuthenticodeSignature [OK]

Hint: Remember: Set-AuthenticodeSignature signs scripts [OK]

Common Mistakes:

• Using non-existent cmdlets like Sign-ScriptCertificate
• Confusing signing with creating certificates
• Misspelling the cmdlet name

3. What will be the output of this PowerShell command if the script is successfully signed?

Set-AuthenticodeSignature -FilePath 'script.ps1' -Certificate $cert

medium

A. The script file is deleted

B. An error message about missing parameters

C. No output is shown

D. A Signature object showing Status as Valid

Solution

1. Step 1: Understand Set-AuthenticodeSignature output

   This cmdlet returns a Signature object with a Status property indicating if signing succeeded.

2. Step 2: Interpret successful signing output

   If signing succeeds, Status will be 'Valid'. No deletion or silent output occurs.

3. Final Answer:

   A Signature object showing Status as Valid -> Option D

4. Quick Check:

   Successful signing = Status Valid output [OK]

Hint: Successful signing returns Status Valid object [OK]

Common Mistakes:

• Expecting no output after signing
• Thinking the script file is deleted
• Confusing error messages with success

4. You run this command but get an error: Set-AuthenticodeSignature : Cannot find the certificate. What is the likely cause?

medium

A. The script is already signed

B. The certificate variable is empty or invalid

C. PowerShell version is too old

D. The script file path is incorrect

Solution

1. Step 1: Analyze the error message

   The error says it cannot find the certificate, meaning the $cert variable is likely empty or invalid.

2. Step 2: Check other options

   Incorrect file path causes a different error. PowerShell version or existing signature do not cause this specific error.

3. Final Answer:

   The certificate variable is empty or invalid -> Option B

4. Quick Check:

   Certificate missing error = invalid $cert [OK]

Hint: Check certificate variable if 'Cannot find certificate' error [OK]

Common Mistakes:

• Assuming file path is the problem
• Thinking PowerShell version causes this error
• Believing script already signed causes this error

5. You want to sign multiple scripts in a folder using the same certificate. Which PowerShell snippet correctly signs all .ps1 files?

hard

A. Get-ChildItem -Path . -Filter '*.ps1' | ForEach-Object { Set-AuthenticodeSignature -FilePath $_.FullName -Certificate $cert }

B. Set-AuthenticodeSignature -FilePath '*.ps1' -Certificate $cert

C. ForEach ($file in '*.ps1') { Set-AuthenticodeSignature -FilePath $file -Certificate $cert }

D. Get-Content '*.ps1' | Set-AuthenticodeSignature -Certificate $cert

Solution

1. Step 1: Identify correct way to get all .ps1 files

   Get-ChildItem -Filter '*.ps1' lists all script files in the folder.

2. Step 2: Apply signing to each file

   Using ForEach-Object to call Set-AuthenticodeSignature on each file with the certificate is correct.

3. Step 3: Check other options

   Set-AuthenticodeSignature -FilePath '*.ps1' -Certificate $cert tries to sign a wildcard path directly (invalid). ForEach ($file in '*.ps1') { Set-AuthenticodeSignature -FilePath $file -Certificate $cert } treats '*.ps1' as a string list (wrong). Get-Content '*.ps1' | Set-AuthenticodeSignature -Certificate $cert pipes file content, not file paths (wrong).

4. Final Answer:

   Get-ChildItem -Path . -Filter '*.ps1' | ForEach-Object { Set-AuthenticodeSignature -FilePath $_.FullName -Certificate $cert } -> Option A

5. Quick Check:

   Use Get-ChildItem + ForEach-Object to sign all scripts [OK]

Hint: Use Get-ChildItem and ForEach-Object to sign multiple files [OK]

Common Mistakes:

• Trying to sign wildcard paths directly
• Using file content instead of file paths
• Treating '*.ps1' as a list of files