self signing of powershell script

Question

I created a selfsigned certifiacte with Power Shell cmdlet

New-SelfSignedCertificate -DnsName test.OJ.com -CertStoreLocation cert:\LocalMachine\My

After that the certificate can be seen in the certlm under personal\certificates

Now I want to use this certificate to sign a PS script. I tried two methods 1. with PS console

$cert = @(Get-ChildItem cert:\CurrentUser\My -CodeSigning)[0] 

Set-AuthenticodeSignature .\scriptTosing.ps1 $cert

after the first command execution the $cert variable is empty

2. Using SingTool.exe

signtool.exe  sign /debug /a ".\scriptTosing.ps1" 

This is the result:

The following certificates were considered:


After EKU filter, 0 certs were left.

After expiry filter, 0 certs were left.

After Private Key filter, 0 certs were left.

SignTool Error: No certificates were found that met all the given criteria.

Please advise

Answer 1

That was tricky to find out - but in the end a very easy solution

The documentation of Get-ChildItem -CodeSigning says:

-CodeSigningCert

Gets only those certificates with code-signing authority. This parameter gets certificates that have "Code Signing" in their EnhancedKeyUsageList property value.

Your $cert variable is empty, because it doesn't get a return from the get-childitem command, because your Certificate doesn't know it's a CodeSigning Certificate, because the EnhancedKeyUsage Property is not equal to "CodeSigning" (also, you store the Cert in LocalMachine, but want to read it from CurrentUser which is wrong).

So when you're creating your certificate with New-SelfSignedCertificate you'll have to tell the certificate, that it has to be a CodeSigning Certificate.

The New-SelfSignedCertificate cmdlet has the following parameter:

-Type (Microsoft.CertificateServices.Commands.CertificateType)

Specifies the type of certificate that this cmdlet creates. The acceptable values for this parameter are:

-- CodeSigningCert -- Custom -- DocumentEncryptionCert -- DocumentEncryptionCertLegacyCsp -- SSLServerAuthentication (default)

So your whole Script has to look like this:

New-SelfSignedCertificate -DnsName test.OJ.com -CertStoreLocation cert:\LocalMachine\My -type CodeSigning
$cert = @(Get-ChildItem cert:\LocalMachine\My -CodeSigning)[0] 
Set-AuthenticodeSignature .\scriptTosing.ps1 $cert