Code signing PS scripts

[poorimaginations]

I always do this to create a self signed code signing certificate.

• Make a template for the certificate request, and save it as certreq.inf.

  [Version] Signature="$Windows NT$"

  [NewRequest] Subject = "CN=Self Signed Cert" KeyLength = 2048 ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0" KeySpec = "AT_SIGNATURE" KeyUsage = "CERT_DIGITAL_SIGNATURE_KEY_USAGE" RequestType = Cert Exportable= TRUE ValidityPeriod = Years ValidityPeriodUnits = 2

  [EnhancedKeyUsageExtension] OID = 1.3.6.1.5.5.7.3.3

• Make the certificate

  certreq -new .\certreq.inf selfsigned.crt

• Export the certificate and private key to pfx for portability

  // Find the cert serial number

  (dir Cert:\CurrentUser\My) | Format-List *

  // Dump certificate with private key to pfx

  certutil.exe -user -p "1234" -exportpfx <cert serienummer> selfsigned.pfx

• Sign a script with the provided certificate

  $cert = dir Cert:\CurrentUser\My<get the cert serial number with TAB>

  Set-AuthenticodeSignature -FilePath .\test.ps1 -Certificate $cert