---
title: Signing PowerShell Scripts
tags: [powershell, security, signing, certificates, execution-policy]
---

# Signing PowerShell Scripts

Signing your PowerShell scripts ensures their integrity and authenticity. It allows you to run scripts in environments with strict execution policies like `AllSigned` or `RemoteSigned`.

**Parent Topic:** [[programming/PowerShell/Scripting|PowerShell Scripting and Programming]]
**Related:** [[programming/PowerShell/SecretManagement|Handling Secrets Securely]]

## 1. Why Sign Scripts?

*   **Integrity**: Ensures the script hasn't been tampered with since it was signed.
*   **Identity**: Confirms who wrote the script.
*   **Policy Compliance**: Required for the `AllSigned` execution policy.

## 2. Obtaining a Code Signing Certificate

To sign a script, you need a Code Signing Certificate.

*   **Public CA**: For scripts distributed publicly or across organizations (e.g., DigiCert, Sectigo). Trusted by default on Windows.
*   **Internal CA**: For scripts used within a specific enterprise domain.
*   **Self-Signed**: For local testing and development only.

## 3. Creating a Self-Signed Certificate (For Testing)

You can create a self-signed certificate using PowerShell.

```powershell
$cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject "CN=MyPowerShellCodeSigningCert" -CertStoreLocation Cert:\CurrentUser\My
```

**Note:** Self-signed certificates are not trusted by other computers by default. You must install this certificate into the "Trusted Root Certification Authorities" and "Trusted Publishers" stores on any machine where you want to run the script.

## 4. Signing a Script

Once you have a certificate, use `Set-AuthenticodeSignature` to sign your `.ps1` file.

```powershell
# 1. Get the certificate
$cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1

# 2. Sign the script
Set-AuthenticodeSignature -FilePath ".\MyScript.ps1" -Certificate $cert
```

If successful, you will see a `Status` of `Valid`.

If you open `MyScript.ps1`, you will see a block of commented text at the bottom starting with `# SIG # Begin signature block`. This is the digital signature.

## 5. Verifying a Signature

You can check if a script is signed and valid without running it.

```powershell
Get-AuthenticodeSignature -FilePath ".\MyScript.ps1"
```

*   **Valid**: The signature is valid and the certificate is trusted.
*   **UnknownError**: The certificate is not trusted (common with self-signed certs).
*   **HashMismatch**: The file content has been modified after signing.

## 6. Running Signed Scripts

If your execution policy is set to `AllSigned`, only signed scripts will run.

```powershell
Set-ExecutionPolicy AllSigned -Scope CurrentUser
.\MyScript.ps1
```

If you modify even a single character in the script after signing it, the signature breaks, and PowerShell will refuse to run it until you re-sign it.

---
Return to [[programming/PowerShell/Scripting|PowerShell Scripting and Programming]]