How to Sign a PowerShell Script with a Code-Signing Certificate
Applies to: Windows Server 2019, 2022 and 2025.
Authenticode signatures prove a script was signed by a trusted certificate and reveal later modification. They do not prove the code is safe.
Automation magnifies both correct and incorrect actions. Use source control, peer review, test environments and least privilege. Visit networkmanager.info.
Prerequisites
- Issue an approved Code Signing certificate.
- Protect the private key.
- Review the script in source control.
- Deploy trust chain to target servers.
Procedure
Step 1: Find certificate
Select an unexpired certificate with private key.
$cert=Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Where-Object NotAfter -GT (Get-Date) | Select-Object -First 1Step 2: Review script hash
Record before signing.
Get-FileHash C:\Scripts\Deploy.ps1 -Algorithm SHA256Step 3: Sign
Use timestamp server only when approved and reachable.
Set-AuthenticodeSignature -FilePath C:\Scripts\Deploy.ps1 -Certificate $certStep 4: Verify signature
Read status and signer.
Get-AuthenticodeSignature C:\Scripts\Deploy.ps1 | Format-List Status,StatusMessage,SignerCertificateStep 5: Test policy
Validate on a representative target under the intended execution policy.
Verification
Signature status should be Valid and hash should remain stable after distribution.
Get-AuthenticodeSignature C:\Scripts\Deploy.ps1
Get-FileHash C:\Scripts\Deploy.ps1 -Algorithm SHA256Rollback
Restore the reviewed unsigned source or re-sign with the correct certificate. Revoke a compromised signer certificate and replace affected scripts.
Security notes
Execution policy is not a security boundary; application control and least privilege provide stronger enforcement.
Official references
Explore Netcloud24 Canada.
