Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd prefer using the AllSigned execution policy with PowerShell, but self-signing my scripts seems to require several hundreds of megabytes of downloading and installation and the signing process seems to be a hassle.

Is there a simpler way to sign a PowerShell script than described in the documentation?

share|improve this question

4 Answers 4

up vote 5 down vote accepted

To do the signing you can use the Set-AuthenticodeSignature cmdlet. This, of course, requires a certificate. If you have a Certificate Authority (unlikely) that will be able to create a code signing certificate. Otherwise there are various tools to create a self-signed certificate.

You install the certificate in your certificate store (open the .cer or .pfx file in Windows Explorer to do this), and then pass it to Set-AuthenticodeSignature (the cert: provider/drive gives access to certificates in your store).

Use

help about_signing

for details (including creating a self-signed certificate using the Windows SDK tools[1]).

[1] I assume this is the big download: you can just install the bits you need, or make use of other tools (OpenSSL includes certificate generation). Getting the SDK is, for this purpose, a one off activity

share|improve this answer
    
I'm accepting this answer and assuming that there is no shortcut and signing just needs to be done as mentioned in the docs. –  Ville Koskinen Jan 19 '10 at 12:30
    
Like quite a few "developer-y" things the initial set up and learning is hard, but the actual practice (especially if done regularly) isn't. –  Richard Jan 20 '10 at 10:31

The best program I have seen for signing scripts is AdminScriptEditor - Professional Edition by iTripoli. Click menu File -> Sign Script -> choose the profile you want to sign it as. About 1 minute later your script is signed.

There is a 45-day free trial... My company bought several licenses, and I am not affiliated with iTripoli; I just love their product.

share|improve this answer

Once I had the certificate, I wanted to use imported on my user account. This regkey gave me an option, Sign, in the context menu (I'm using Windows 7). If the certificate you want to sign with is stored differently, just change the PowerShell command at the end.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Classes\Microsoft.PowerShellScript.1]

[HKEY_CURRENT_USER\Software\Classes\Microsoft.PowerShellScript.1\Shell]

[HKEY_CURRENT_USER\Software\Classes\Microsoft.PowerShellScript.1\Shell\Sign]

[HKEY_CURRENT_USER\Software\Classes\Microsoft.PowerShellScript.1\Shell\Sign\Command]
@="C:\\\Windows\\\System32\\\WindowsPowerShell\\\v1.0\\\powershell.exe -command Set-AuthenticodeSignature '%1' @(Get-ChildItem cert:\\\CurrentUser\\\My -codesigning)[0]"
share|improve this answer

I use this PowerShell script:

## sign-script.ps1
## Sign a powershell script with a Thawte certificate and 
## timestamp the signature
##
## usage: ./sign-script.ps1 c:\foo.ps1 

param([string] $file=$(throw “Please specify a script filepath.”)) 

$certFriendlyName = "Thawte Code Signing"
$cert = gci cert:\CurrentUser\My -codesigning | where -Filter 
  {$_.FriendlyName -eq $certFriendlyName}

# https://www.thawte.com/ssl-digital-certificates/technical-  
#   support/code/msauth.html#timestampau
# We thank VeriSign for allowing public use of their timestamping server.
# Add the following to the signcode command line: 
# -t http://timestamp.verisign.com/scripts/timstamp.dll 
$timeStampURL = "http://timestamp.verisign.com/scripts/timstamp.dll"

if($cert) {
    Set-AuthenticodeSignature -filepath $file -cert $cert -IncludeChain All -   
      TimeStampServer $timeStampURL
}
else {
    throw "Did not find certificate with friendly name of `"$certFriendlyName`""
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.