A code-signing certificate is a digital identity used to sign software or scripts and help others verify who issued them. Trust depends on the certificate authority (CA) that vouches for the holder’s identity; protect the certificate’s private key carefully. section 21.2
Choose the certificate source according to where the code will run:
- Use a commercial CA when distributing signed tools outside the organization; expect substantial identity verification and organizational issuance. section 21.2 section 21.4.1
- Use organizational PKI, such as AD CS, when code remains inside the organization and domain members can trust the issuing CA through Group Policy. section 21.2 section 21.4.1
- Use a self-signed certificate for personal development or testing, but replace it with a real certificate before distributing code to others. section 21.2 section 21.4.1
PS Cert:\> New-SelfSignedCertificate -type CodeSigningCert -Subject "CN=James Petty" -CertStoreLocation Cert:\CurrentUser\My\ -testroot PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My Thumbprint Subject EnhancedKeyUsageList ---------- ------- ----------- F33E9122D73BE220117339E9647F0037F3F875A6 CN=James Petty Code Signing
Create a test code-signing certificate in the current user store with the PowerShell PKI module and the TestRoot option. section 21.4.1
