PowerShell Code Signing

Photo by Tadas Sar on Unsplash

If you are a system administrator, you might have had to run Task Scheduler jobs or delegate tasks to end-users. But have you wondered how you could run these tasks securely? How do you ensure the integrity and quality of the scripts on your system? This is where code signing can help.

A digital signature is a process that guarantees that a file or message has not been altered after the signature has been calculated. Signing scripts ensures the integrity of a script you run. After you verify that a script is safe to run, you can digitally sign the script to prevent others from tampering with it.

Files can be signed with signing certificates. And by adjusting Powershell Execution Policies to allow only signed scripts to run, you maintain control over the integrity of the scripts on your system. Today, let’s dive into how Powershell code signing works and how to sign a script to use!

Configuring signing certificates

First, let’s create a certificate template! A certificate template will enable users to request individual certificates to sign their scripts.

Creating a certificate template

https://idonika.com/ozt/video-cocodrilos-v-cienfuegos-v-es-co-1ysx3-2.php
https://idonika.com/ozt/videos-cocodrilos-v-cienfuegos-v-es-co-1zed2-10.php
http://illinois.colomboserboli.com/jjm/video-inter-v-napoli-v-yt2-1bzu-8.php
https://idonika.com/ozt/Video-cocodrilos-v-cienfuegos-v-es-co-1mrw-12.php
http://uix.negronicocktailbar.com/vfg/videos-cocodrilos-v-cienfuegos-v-es-co-1vjx-19.php
http://illinois.colomboserboli.com/jjm/v-ideos-inter-v-napoli-v-yt2-1ahd-2.php
http://uix.negronicocktailbar.com/vfg/video-cocodrilos-v-cienfuegos-v-es-co-1ruq-13.php
https://idonika.com/ozt/v-ideos-cocodrilos-v-cienfuegos-v-es-co-1usk-11.php
http://illinois.colomboserboli.com/jjm/videos-inter-v-napoli-v-yt2-1yos-1.php
http://illinois.colomboserboli.com/jjm/video-inter-v-napoli-v-yt2-1lsp-13.php
https://idonika.com/ozt/Video-cocodrilos-v-cienfuegos-v-es-co-1wet-2.php
http://uix.negronicocktailbar.com/vfg/Video-cocodrilos-v-cienfuegos-v-es-co-1rcq2-12.php
http://illinois.colomboserboli.com/jjm/video-inter-v-napoli-v-yt2-1ozc-5.php
https://totssants.com/snj/video-Piratas-Artemisa-v-en-gb-mwl-.php
http://international.actiup.com/yts/Video-Mayabeque-Villa-Clara-v-en-gb-1owy-6.php
http://illinois.colomboserboli.com/jjm/videos-parma-v-kaliari-v-yt2-1vmj-15.php
http://illinois.colomboserboli.com/jjm/Video-parma-v-kaliari-v-yt2-1vgf-6.php
http://illinois.colomboserboli.com/jjm/video-parma-v-kaliari-v-yt2-1lnp-12.php
http://home.gruposio.es/gmy/video-Piratas-Artemisa-v-en-gb-uek-.php
http://illinois.colomboserboli.com/jjm/video-parma-v-kaliari-v-yt2-1ssm-10.php
http://illinois.colomboserboli.com/jjm/videos-parma-v-kaliari-v-yt2-1zvb-17.php
http://home.gruposio.es/gmy/videos-piratas-v-artemisa-v-es-co-1ogn2-18.php
http://illinois.colomboserboli.com/jjm/v-ideos-spetsiia-v-bolonia-v-yt2-1qbg-14.php
http://evokate.org/fwx/video-Piratas-Artemisa-v-en-gb-ksa-.php
http://home.gruposio.es/gmy/video-piratas-v-artemisa-v-es-co-1axs2-8.php
http://illinois.colomboserboli.com/jjm/video-spetsiia-v-bolonia-v-yt2-1sdx-17.php
http://international.actiup.com/yts/video-Mayabeque-Villa-Clara-v-en-gb-1wyo-2.php
http://illinois.colomboserboli.com/jjm/v-ideos-spetsiia-v-bolonia-v-yt2-1czc-9.php
http://illinois.colomboserboli.com/jjm/Video-spetsiia-v-bolonia-v-yt2-1pxn-18.php
http://home.gruposio.es/gmy/Video-piratas-v-artemisa-v-es-co-1xhn2-10.php
http://home.gruposio.es/gmy/Video-piratas-v-artemisa-v-es-co-1mdb-4.php
http://international.actiup.com/yts/Video-mayabeque-v-villa-clara-v-es-co-1epz2-14.php
http://illinois.colomboserboli.com/jjm/video-spetsiia-v-bolonia-v-yt2-1bnu-9.php
http://home.gruposio.es/gmy/Video-piratas-v-artemisa-v-es-co-1dvl-7.php
http://international.actiup.com/yts/videos-mayabeque-v-villa-clara-v-es-co-1ann-4.php
http://illinois.colomboserboli.com/jjm/Video-pszh-v-lorian-v-yt2-1ypx-2.php
http://international.actiup.com/yts/video-mayabeque-v-villa-clara-v-es-co-1qqp2-9.php
http://international.actiup.com/yts/Video-mayabeque-v-villa-clara-v-es-co-1zvp-9.php
http://illinois.colomboserboli.com/jjm/v-ideos-pszh-v-lorian-v-yt2-1rtj-4.php
http://home.gruposio.es/gmy/Video-Sancti-Spiritus-Camaguey-v-en-gb-1phk-7.php
http://international.actiup.com/yts/videos-mayabeque-v-villa-clara-v-es-co-1efm2-4.php
https://idonika.com/ozt/videos-Alazanes-Guantanamo-v-en-gb-1snr-.php
http://illinois.colomboserboli.com/jjm/videos-pszh-v-lorian-v-yt2-1qer-17.php
http://illinois.colomboserboli.com/jjm/video-pszh-v-lorian-v-yt2-1ocm-18.php
http://uix.negronicocktailbar.com/vfg/video-Alazanes-Guantanamo-v-en-gb-1ylf-12.php
http://illinois.colomboserboli.com/jjm/video-pszh-v-lorian-v-yt2-1thy-2.php
https://totssants.com/snj/v-ideos-Piratas-Artemisa-v-en-gb-wyp-.php
http://home.gruposio.es/gmy/Video-Sancti-Spiritus-Camaguey-v-en-gb-1pyr-13.php
http://illinois.colomboserboli.com/jjm/Video-lion-v-brest-v-yt2-1nyt-1.php
http://illinois.colomboserboli.com/jjm/Video-lion-v-brest-v-yt2-1ado-17.php
http://evokate.org/fwx/video-Piratas-Artemisa-v-en-gb-suv-.php
https://totssants.com/snj/video-piratas-v-artemisa-v-es-co-1wrq2-6.php
http://illinois.colomboserboli.com/jjm/v-ideos-lion-v-brest-v-yt2-1rtn-3.php
http://international.actiup.com/yts/Video-Industriales-Pinar-del-Rio-v-en-gb-1pdg-4.php
https://totssants.com/snj/video-piratas-v-artemisa-v-es-co-1kur-14.php
http://home.gruposio.es/gmy/Video-Sancti-Spiritus-Camaguey-v-en-gb-1tdf-7.php
http://illinois.colomboserboli.com/jjm/video-lion-v-brest-v-yt2-1cnk-6.php
http://evokate.org/fwx/video-piratas-v-artemisa-v-es-co-1fck2-7.php
https://totssants.com/snj/v-ideos-piratas-v-artemisa-v-es-co-1use-3.php
http://illinois.colomboserboli.com/jjm/video-lion-v-brest-v-yt2-1ohg-19.php
http://home.gruposio.es/gmy/video-sancti-spiritus-v-camaguey-v-es-co-1ycy2-11.php
http://evokate.org/fwx/videos-piratas-v-artemisa-v-es-co-1udr-7.php
https://totssants.com/snj/v-ideos-piratas-v-artemisa-v-es-co-1kdg-17.php
http://home.gruposio.es/gmy/video-sancti-spiritus-v-camaguey-v-es-co-1hdd-14.php
http://illinois.colomboserboli.com/jjm/v-ideos-monako-v-lans-v-yt2-1hmg-12.php
http://home.gruposio.es/gmy/videos-sancti-spiritus-v-camaguey-v-es-co-1lrb2-18.php
https://totssants.com/snj/video-piratas-v-artemisa-v-es-co-1rhe-12.php
http://evokate.org/fwx/videos-piratas-v-artemisa-v-es-co-1ksx-8.php
http://illinois.colomboserboli.com/jjm/video-monako-v-lans-v-yt2-1qfj-6.php
http://home.gruposio.es/gmy/Video-sancti-spiritus-v-camaguey-v-es-co-1bai2-16.php
http://evokate.org/fwx/videos-piratas-v-artemisa-v-es-co-1evw2-1.php
http://illinois.colomboserboli.com/jjm/videos-monako-v-lans-v-yt2-1smu-15.php
http://evokate.org/fwx/Video-piratas-v-artemisa-v-es-co-1ejy2-11.php
http://home.gruposio.es/gmy/Video-sancti-spiritus-v-camaguey-v-es-co-1xnw2-12.php
http://illinois.colomboserboli.com/jjm/Video-monako-v-lans-v-yt2-1wzv-15.php
https://totssants.com/snj/Video-Sancti-Spiritus-Camaguey-v-en-gb-1cpf-12.php
http://illinois.colomboserboli.com/jjm/videos-monako-v-lans-v-yt2-1wox-15.php
http://international.actiup.com/yts/Video-Industriales-Pinar-del-Rio-v-en-gb-1zgr-8.php
http://illinois.colomboserboli.com/jjm/Video-vest-khem-v-kristal-pelas-v-yt2-1bqb-12.php
http://evokate.org/fwx/video-Sancti-Spiritus-Camaguey-v-en-gb-1dfb-11.php
http://illinois.colomboserboli.com/jjm/video-vest-khem-v-kristal-pelas-v-yt2-1ljz-12.php
http://uix.negronicocktailbar.com/vfg/Video-Alazanes-Guantanamo-v-en-gb-1zpp-18.php
http://illinois.colomboserboli.com/jjm/videos-vest-khem-v-kristal-pelas-v-yt2-1vdi-1.php
https://idonika.com/ozt/videos-Alazanes-Guantanamo-v-en-gb-1hzk-4.php
https://totssants.com/snj/video-Sancti-Spiritus-Camaguey-v-en-gb-1qjb-10.php
http://illinois.colomboserboli.com/jjm/video-vest-khem-v-kristal-pelas-v-yt2-1pha-7.php
http://illinois.colomboserboli.com/jjm/videos-vest-khem-v-kristal-pelas-v-yt2-1ipf-2.php
http://evokate.org/fwx/v-ideos-Sancti-Spiritus-Camaguey-v-en-gb-1oeq-18.php
https://totssants.com/snj/v-ideos-Sancti-Spiritus-Camaguey-v-en-gb-1xcq-2.php
http://international.actiup.com/yts/v-ideos-Industriales-Pinar-del-Rio-v-en-gb-1kqb-1.php
https://totssants.com/snj/video-sancti-spiritus-v-camaguey-v-es-co-1alz2-7.php
http://evokate.org/fwx/Video-Sancti-Spiritus-Camaguey-v-en-gb-1hoo-8.php
https://totssants.com/snj/Video-sancti-spiritus-v-camaguey-v-es-co-1adg2-1.php
http://international.actiup.com/yts/videos-industriales-v-pinar-del-rio-v-es-co-1afi-15.php
https://totssants.com/snj/Video-sancti-spiritus-v-camaguey-v-es-co-1hzk2-10.php
http://international.actiup.com/yts/Video-industriales-v-pinar-del-rio-v-es-co-1wxd2-6.php
http://international.actiup.com/yts/Video-industriales-v-pinar-del-rio-v-es-co-1sbc2-17.php
https://totssants.com/snj/Video-sancti-spiritus-v-camaguey-v-es-co-1erq-17.php
http://evokate.org/fwx/video-sancti-spiritus-v-camaguey-v-es-co-1qxd2-5.php
http://home.gruposio.es/gmy/videos-Cocodrilos-Cienfuegos-v-en-gb-1aqv-12.php

You should see a window prompting you to set the properties of the new template. In the “General” tab, you will be able to set the name of the template. In the “Compatibility” tab, you’ll be able to set the Certificate Authority and Certificate Recipient. In the “Cryptography” tab, you can configure the details of the cryptographic algorithm used, like Cryptographic Provider, Algorithm name, Key Size, and more.

And in the “Security” tab, you can configure which users or groups can create code signing certificates. Users that are allowed to create code signing certificates need to be granted “Enroll” and “Read” permissions.

If you already have a certificate template configured, you can simply import it for use.

ldifde -i -k -f TEMPLATE_FILE

Back in “Administrative Tools > Certification Authority”, right-click the “Certificate Templates” then go to “New > Certificate Template to Issue”.

Creating a signing certificate

On a development machine, you can now create a code signing certificate. First, open the Microsoft Management Console (mmc.msc). Then, go to “File > Add/Remove Snap-in”. From the “Available snap-ins” menu, select “Certificates” and click “Add”, then “Ok”.

In the original window, right-click on “Personal”, select “All Tasks > Request New Certificate”. Tick the appropriate certificate and click on “Enroll”. A code signing certificate will be created.

You can import a certificate to use by running this command.

Import-Certificate -FilePath "CERT_TO_IMPORT" -CertStoreLocation cert:CERT_LOCATION

You can also export a certificate from a certificate store into a file.

$cert = Get-ChildItem -Path cert:CERT_LOCATION 
Export-Certificate -Cert $cert -FilePath FILE_PATH

Signing scripts

Now you can sign a script with the code signing certificate! These commands will retrieve a code signing certificate and use it to sign your script.

$cert=Get-ChildItem -Path Cert:CERT_LOCATION -CodeSigningCert 
Set-AuthenticodeSignature -FilePath SCRIPT_PATH -Certificate $cert

You can now run your signed script.

SCRIPT_PATH

How to prevent digital signatures from expiring

The digital signature in a script is valid until the signing certificate expires. Or, the signature can remain valid if a timestamp server can verify that the script was signed while the signing certificate was valid. Since most signing certificates expire after one year, using a timestamp server ensures that users can use your script for a longer time.

Powershell execution policies

PowerShell’s execution policy controls how PowerShell loads configuration files and runs scripts. By setting appropriate execution policies, you can prevent the execution of malicious scripts. In particular, setting the execution policy to “AllSigned” can make sure that only scripts and configuration files that have been signed with a trusted certificate can run on your systems.

To find the effective execution policy on your computer, you can use:

Get-ExecutionPolicy

You can set PowerShell’s execution policy to AllSigned by using this command.

Set-ExecutionPolicy AllSigned

Conclusion

Signing scripts and restricting Powershell’s execution policy accordingly is a good way to ensure the integrity of the scripts you run. In this post, we went through how you can create a code signing certificate and how you can use that certificate to sign scripts.

--

--

--

Writing mostly to myself. Sharing some of it with you. Hope it helps.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

CS50 2020 Pset 3: Of Runoffs and Politics

Flutter MVVM Architecture Generator

How To Pretty Print in Python

OpenVPN-based dockerised “staging” test setup

Deploying Go App with NGINX + Docker to Amazon EC2

How to upload code onto Github In just 5 minutes

#github #repository # code #programming #uploadcode #coding #C++ #codingday #Coder #programmer #Github #git #100daysofcode

Sass -Redbull for CSS

An introduction to Debugging (in C and lldb), Part- I

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Ovolker Vontangep

Ovolker Vontangep

Writing mostly to myself. Sharing some of it with you. Hope it helps.

More from Medium

Carb Loading: Science or Myth?

marathon runner wearing sunglasses in a summer race

How To Start Exercising — Even If You HATE Exercise — The Neuroscience And Brain Hacks That Works

My Daily Teacher

Motivation Isn’t Always Motivating