A certification authority (CA) is a trusted entity that validates identities, embeds them in digital certificates, and signs those certificates. Trusting the CA lets a system trust certificates it issues. section 21.2
Choose the issuing model according to where the signed code will be used:
- Use a commercial CA when distributing tools outside the organization; expect organizational ownership and substantial identity verification. section 21.2
- Use an internal CA through PKI or Active Directory Certificate Services when domain members need to trust organizational code. section 21.2
- Use a self-signed certificate for personal development or testing, but replace it before distributing code to others. section 21.2
PS Cert:\> New-SelfSignedCertificate -type CodeSigningCert -Subject "CN=James Petty" -CertStoreLocation Cert:\CurrentUser\My\ -testroot PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My Thumbprint Subject EnhancedKeyUsageList ---------- ------- ----------- F33E9122D73BE220117339E9647F0037F3F875A6 CN=James Petty Code Signing
Create a test code-signing certificate with the PowerShell PKI module and store it in the current user's certificate store. section 21.4.1
