{"id":12152,"date":"2026-04-14T19:26:00","date_gmt":"2026-04-15T00:26:00","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=12152"},"modified":"2026-04-20T15:32:58","modified_gmt":"2026-04-20T20:32:58","slug":"signing-powershell-scripts","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=12152","title":{"rendered":"Signing PowerShell Scripts"},"content":{"rendered":"\n

A quick PowerShell script to report on its own signature data:<\/p>\n\n\n

\n$scriptPath = $PSCommandPath\n\nif (-not $scriptPath) {\n    throw 'This script must be run from a .ps1 file so $PSCommandPath is available.'\n}\n\n$sig = Get-AuthenticodeSignature -FilePath $scriptPath\n\nWrite-Host "Script path: $scriptPath`n" -ForegroundColor Cyan\n\n[PSCustomObject]@{\n    Status                  = $sig.Status\n    StatusMessage           = $sig.StatusMessage\n    SignatureType           = $sig.SignatureType\n    IsOSBinary              = $sig.IsOSBinary\n    SignerSubject           = $sig.SignerCertificate.Subject\n    SignerThumbprint        = $sig.SignerCertificate.Thumbprint\n    SignerNotBefore         = $sig.SignerCertificate.NotBefore\n    SignerNotAfter          = $sig.SignerCertificate.NotAfter\n    TimeStamperSubject      = $sig.TimeStamperCertificate.Subject\n    TimeStamperThumbprint   = $sig.TimeStamperCertificate.Thumbprint\n} | Format-List\n<\/pre><\/div>\n\n\n
To sign the script:<\/p>\n\n\n
\n$thumb = '87E4C1F40D1DB8486F1E9093A76626AB1DFDEA30'\n$scriptPath = "$env:USERPROFILE\\git\\CyberSecurity\\misc\\CheckPSSignature.ps1"\n\n$cert = Get-ChildItem Cert:\\CurrentUser\\My, Cert:\\LocalMachine\\My |\n    Where-Object {\n        $_.Thumbprint -eq $thumb -and\n        $_.HasPrivateKey -and\n        ($_.EnhancedKeyUsageList | Where-Object {\n            $_.ObjectId -eq '1.3.6.1.5.5.7.3.3' -or $_.FriendlyName -eq 'Code Signing'\n        })\n    } |\n    Select-Object -First 1\n\nif (-not $cert) {\n    throw "Code signing certificate $thumb not found."\n}\n\nSet-AuthenticodeSignature -FilePath $scriptPath -Certificate $cert\nGet-AuthenticodeSignature -FilePath $scriptPath | Format-List *\n<\/pre><\/div>\n\n\n
And now the script is signed:<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"
A quick PowerShell script to report on its own signature data: To sign the script: And now the script is signed:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[2189],"class_list":["post-12152","post","type-post","status-publish","format-standard","hentry","category-system-administration","tag-code-signing"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12152"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12152\/revisions"}],"predecessor-version":[{"id":12154,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12152\/revisions\/12154"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}