-
Notifications
You must be signed in to change notification settings - Fork 36
/
Copy pathHow to sign powershell ps1 scripts.ps1
55 lines (42 loc) · 2 KB
/
How to sign powershell ps1 scripts.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
Set-ExecutionPolicy AllSigned -Force #Configure script execution policy to all script must be signed
$scriptPath = '\\192.168.34.16\RemoteScripts\NewScript.ps1' #This is share path, Where all scripts will be hosted
$certStoreLocation = 'Cert:\CurrentUser\My' #This is local certification store
$certificateName = '\\192.168.34.16\RemoteScripts\PSCodeCertifiate.cer' #This is certificate to give to users
#Create a code-signing, self-signed certificate
$selfSignedCertInfo = @{
Subject = 'vCloud-lab.com Code Signing'
Type = 'CodeSigning'
CertStoreLocation = $certStoreLocation
}
$cert = New-SelfSignedCertificate @selfSignedCertInfo
#View the newly created certificate
Get-ChildItem -Path $certStoreLocation -CodeSigningCert | Where-Object {$_.SubjectName.Name -Match $_.$selfSignedCertInfo.Subject}
#Create a simple script
$scriptCode = @"
#Demo Script for Testing
Write-Host "ComputerName: $env:COMPUTERNAME" -BackgroundColor Green
ipconfig
"@
$scriptCode | Out-File -FilePath $scriptPath
#View the files
Get-ChildItem -Path $scriptPath
#Sign the Script
$codeSignInfo = @{
Certificate = $Cert
FilePath = $scriptPath
}
Set-AuthenticodeSignature @codeSignInfo
#View the files
Get-ChildItem -Path $scriptPath
#Test the signature
Get-AuthenticodeSignature -FilePath $scriptPath | Format-List *
#Export certificate to file on sharepath
Export-Certificate -Cert $cert -FilePath $certificateName
#Import it to users trusted root certificate autorities
Import-Certificate -FilePath $certificateName -CertStoreLocation 'Cert:\CurrentUser\Root' -Confirm:$false
#Import certificate to Trusted publisher store location
Import-Certificate -FilePath $certificateName -CertStoreLocation 'Cert:\CurrentUser\TrustedPublisher' -Confirm:$false
#Re-sign with a trusted certificate
Set-AuthenticodeSignature @codeSignInfo
#Check the script's signature
Get-AuthenticodeSignature -FilePath $scriptPath | Format-List