So let's talk about understanding script signing.
Now that we've kind of got our head around the bits that we need to do,
so we open the editor, we start to write some code,
and we comment everything,
but let's say we're going to issue this to somebody else,
then we need to look at signing.
So why would you digitally sign a PowerShell script?
Well, first off, this allows you to separate custom developed,
tested, and personal scripts.
It also means that your scripts are not malicious, and
we'll touch on that in a second.
It's not 100% true.
It can also validate the script is doing versus its intended purpose.
So the reason for signing them is so that somebody can look at it and say,
well,
it's been signed with a signature, so someone took a little bit of
an extra step to make sure that that was okay.
It doesn't necessarily guarantee that the script is not malicious,
and it doesn't necessarily guarantee that the script
is doing something it shouldn't be.
But normally, for a digitally signed PowerShell script,
it's been checked and validated,
so they're a lot more trusted. So let's understand this a little bit more.
To do this,
you first must sign a script with a code signing
certificate. So not just any certificate.
It has to be a code signing certificate.
There are two types of certificates that are suitable for this.
One is a public certificate, which you would go and purchase from a vendor,
and then one is a self‑signed that you would either create locally or you would
issue from a certificate authority within the organization.
And you can use self‑signed certificates to sign
scripts that you write for yourself.
Obviously,
using a self‑signed one is a little bit harder to distribute to other people
because they would have to trust that self‑signed certificate.
So two different certificate types. The public one is one that you
can share the script with other computers as they normally trust the
certificate authorities by default, because it will come from a
public one of those. Of course, locally ones, they are self‑signed,
and it won't execute on other computers unless they trust that self‑signed
certificate too, which is a bit more complicated if you're building a script
that you want to distribute to the world, and you say,
hey, just use my certificate.
You can trust me.
So how do we create a self‑signed certificate?
Well, first off, I've got the PowerShell script,
so C:\Documents\Code\Script.ps1.
I've spent all the time building it.
I can actually use a PowerShell command to do this. So I can
say New‑SelfSignedCertificate, give it a DNS name, where the
certificate store location is,
which is going to be your personal, so CurrentUser\My, the
type, which needs to be CodeSigningCert, and then the subject
we wish to assign to that one.
I can then retrieve that code signing certificate by simply going
Get‑ChildItem in that location, and get me the CodeSigningCert.
Now, of course I'm doing it this way, and it's going to get the first one.
Hopefully, the first one is the one that you created.
But if you have multiple, you might need to change the indexer. Then,
of course,
you set the code signing certificate for the PowerShell script, and you can use
a PowerShell command for this too. You can say Set‑AuthenticodeSignature, the
script path to the certificate that you've created.
And then, of course,
you can validate that by saying Get the
AuthenticodeSignature for the script and just format it to a table so I can see what that looks like.