Skip to content

Tag: Certificate

How to Sign Scripts in PowerShell

PowerShell is a powerful scripting language used for task automation and configuration management across various platforms. While its versatility is one of its greatest strengths, it also introduces potential security risks, particularly when running scripts from untrusted sources. Signing PowerShell scripts is a crucial step in ensuring the integrity and authenticity of the scripts you run, thereby protecting your systems from malicious code. This guide will walk you through the process of signing PowerShell scripts.

Why Sign PowerShell Scripts?

Before diving into the how-to, it’s important to understand why script signing is essential:

  1. Security: Signing scripts helps ensure that the script has not been tampered with and is from a trusted source.
  2. Compliance: Many organisations have policies that require scripts to be signed for auditing and compliance purposes.
  3. Trust: Users can verify the identity of the script author, fostering trust in the script’s legitimacy.
  4. Execution Policy: PowerShell has various execution policies (e.g., AllSigned, RemoteSigned) that control the conditions under which scripts can run. Signing scripts is necessary to meet the requirements of stricter policies.

Prerequisites for Script Signing

Before you can sign a PowerShell script, you need:

  1. A Code Signing Certificate: This can be obtained from a trusted Certificate Authority (CA) or generated internally if your organisation uses a Public Key Infrastructure (PKI).
  2. PowerShell: Ensure you have PowerShell 5.1 or later, as it includes the necessary cmdlets for script signing.

Generating a Self-Signed Certificate

For demonstration purposes, we’ll create a self-signed certificate. In a production environment, it is recommended to use a certificate issued by a trusted CA.

Create a Self-Signed Certificate:

$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -Subject "CN=PowerShell Script Signing"

This command creates a new self-signed certificate in the current user’s certificate store with the subject “PowerShell Script Signing”.

Export the Certificate:

$certPath = "C:\path\to\cert.pfx"
$password = ConvertTo-SecureString -String "YourPassword" -Force -AsPlainText
Export-PfxCertificate -Cert "Cert:\CurrentUser\My\$($cert.Thumbprint)" -FilePath $certPath -Password $password

This exports the certificate to a .pfx file, secured with a password.

Importing the Certificate

To sign scripts, the certificate must be imported into the certificate store:

Import the Certificate:

$password = ConvertTo-SecureString -String "YourPassword" -Force -AsPlainText
Import-PfxCertificate -FilePath "C:\path\to\cert.pfx" -CertStoreLocation Cert:\CurrentUser\My -Password $password

This command imports the certificate into the current user’s personal certificate store.

Signing a PowerShell Script

With the certificate in place, you can now sign your PowerShell script:

Get the Certificate:

$cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object { $_.Subject -eq "CN=PowerShell Script Signing" }

Sign the Script:

Set-AuthenticodeSignature -FilePath "C:\path\to\script.ps1" -Certificate $cert

This command signs the script using the specified certificate.

Verifying the Script Signature

To verify that the script is properly signed:

Check the Signature:

$signature = Get-AuthenticodeSignature -FilePath "C:\path\to\script.ps1"

This command retrieves the signature information for the script. The Status property should indicate that the script is signed and valid.

Execution Policies and Script Signing

PowerShell execution policies govern the conditions under which scripts can run. The relevant policies for script signing are:

  1. AllSigned: All scripts and configuration files must be signed by a trusted publisher.
  2. RemoteSigned: Downloaded scripts must be signed by a trusted publisher.

To set an execution policy:

Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope CurrentUser

This sets the execution policy to AllSigned for the current user, ensuring that only signed scripts can run.


Signing PowerShell scripts is a crucial step in enhancing the security and integrity of your automation tasks. By following this guide, you can create and use certificates to sign your scripts, thereby ensuring that your scripts are from a trusted source and have not been tampered with. Remember, while self-signed certificates are useful for testing and development, always use certificates from a trusted CA for production environments.

© 2024 - Powered by Coffee & Magic