A self-signed certificate is signed by its own subject instead of an independent certificate authority. It is convenient for signing PowerShell scripts during development or for personal desktop use, but it should be replaced with a trusted certificate when code is shared. section 21.2
Use a self-signed certificate with these boundaries in mind:
- Create one for testing or scripts that never leave your desktop. section 21.4.1
- Use an internal PKI or commercial certificate when distributing code to others. section 21.2
- Protect the private key carefully, including with password protection in the Windows certificate store. section 21.2
- Trust the certificate’s root locally before using it, because a computer does not automatically trust certificates it creates. section 21.4.2
Create a code-signing certificate
Run New-SelfSignedCertificate with the CodeSigningCert type, your own CN subject, the current-user certificate store, and the -TestRoot parameter. PowerShell may initially report an unknown error because the certificate chain is untrusted. section 21.4.1
PS Cert:\> New-SelfSignedCertificate -type CodeSigningCert -Subject "CN=James Petty" -CertStoreLocation Cert:\CurrentUser\My\ -testroot PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My Thumbprint Subject EnhancedKeyUsageList ---------- ------- ----------- F33E9122D73BE220117339E9647F0037F3F875A6 CN=James Petty Code Signing
Use this listing as a concrete template for creating a self-signed PowerShell code-signing certificate, then replace the subject name. section 21.4.1
PS C:\> dir Cert:\CurrentUser\My\ -CodeSigningCert PSParentPath: Microsoft.PowerShell.Security\Certificate::CurrentUser\My Thumbprint Subject ---------- ------- F33E9122D73BE220117339E9647F0037F3F875A6CN=James Petty
Use the certificate-store listing to locate installed code-signing certificates and identify the one to use by its thumbprint. section 21.4.1
