PowerShell: Essentials of Digitally Signing Scripts

Digitally signing PowerShell scripts is an essential skill for system administrators aiming to enhance security and establish trusted script execution environments. This comprehensive guide details the process of creating a digital signature for PowerShell scripts, using a professional and systematic approach.

Starting with PowerShell

Launch PowerShell: Open the PowerShell command-line interface, which can be accessed through the Start menu or by typing powershell in the Run dialog (Win + R).

Steps to Digitally Sign PowerShell Scripts

Creating a Self-Signed Certificate

Generate a Self-Signed Certificate: Create a certificate for code signing. Replace the DNS name with your details.

New-SelfSignedCertificate -DnsName admin@companydomain.com -CertStoreLocation Cert:\CurrentUser\My\ -FriendlyName "CompanyCodeSigningCert" -NotAfter (Get-Date).AddYears(10) -KeyLength 4096 -Type Codesigning

Listing and Exporting the Certificate

List Certificates: View the available code signing certificates in the current user's personal store.

Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert

Output:

Thumbprint Subject ---------- ------- ABC123CDA04D7583221FE14C32D7B7570537905A CN=admin@companydomain.com

Export the Public Key: Export the certificate's public key.

Export-Certificate -Cert Cert:\CurrentUser\My\ABC123CDA04D7583221FE14C32D7B7570537905A -FilePath C:\CompanyPublicCert.cer

Trusting the Certificate

Import Certificate as Trusted Root: Import the certificate to the trusted root certification authority.

Import-Certificate -CertStoreLocation Cert:\LocalMachine\AuthRoot -FilePath C:\CompanyPublicCert.cer

Import as Trusted Publisher: Also, import it to the trusted publisher store.

Import-Certificate -CertStoreLocation Cert:\LocalMachine\TrustedPublisher -FilePath C:\CompanyPublicCert.cer

Creating and Signing a Script

Create a PowerShell Script: Develop a script to be signed.

New-Item 'C:\example.ps1' -type file

Edit C:\example.ps1 and add your script content.

Digitally Sign the Script: Use the certificate to sign the script.

Set-AuthenticodeSignature -FilePath C:\example.ps1 -Certificate (Get-ChildItem -Path Cert:\CurrentUser\My\ABC123CDA04D7583221FE14C32D7B7570537905A)

Output:

SignerCertificate Status Path ----------------- ------ ---- ABC123CDA04D7583221FE14C32D7B7570537905A Valid example.ps1

Verifying and Executing the Signed Script

Set Execution Policy: Change the PowerShell execution policy to allow only signed scripts.

Set-ExecutionPolicy AllSigned

Execute the Signed Script: Run your digitally signed script.

C:\example.ps1

Testing with an Unsigned Script: Attempt to execute an unsigned script to confirm the policy enforcement.

C:\unsignedscript.ps1

Expected Error:

File C:\unsignedscript.ps1 cannot be loaded. The file C:\unsignedscript.ps1 is not digitally signed...

Conclusion

Congrats! You have successfully learned how to create, sign, and execute digitally signed PowerShell scripts. This knowledge is crucial for ensuring script integrity and trustworthiness in a secure PowerShell scripting environment. By following these steps, system administrators can effectively implement and enforce script signing policies, thereby elevating the security posture of their systems.