How to Sign PowerShell Scripts

Check That the Certificate Can Sign Scripts

Before working with the .ps1 file, confirm that the certificate you plan to use is the intended signing identity and that PowerShell can access its private key.

Importing a certificate into Windows is not enough if the matching private key is missing or inaccessible. The signing operation needs the private-key capability associated with the certificate.

Find the Code-Signing Certificate in PowerShell

PowerShell exposes certificate stores through the Cert: provider. The two stores most commonly relevant to an interactive user's certificate lookup are the current user's personal store and the local machine personal store.

Get-ChildItem Cert:\CurrentUser\My

Get-ChildItem Cert:\LocalMachine\My

Start by looking at the certificate subject and other identifying properties. Do not assume the first certificate returned by the store is the correct production identity.

Confirm the Certificate Has a Private Key

Use the certificate object returned by the provider and check its private-key availability. This catches one of the most common setup failures before you attempt to sign the script.

Get-ChildItem Cert:\CurrentUser\My |
  Where-Object {$_.HasPrivateKey} |
  Select-Object Subject, Thumbprint, NotAfter, HasPrivateKey

If the intended certificate is absent from this result, investigate the certificate import, key association, certificate store, account permissions, or hardware/remote provider configuration before continuing.

Select the Exact Signing Certificate

When multiple certificates are present, select the intended certificate explicitly. You can inspect the store and assign the chosen certificate to a variable for the signing operation.

$cert = Get-ChildItem Cert:\CurrentUser\My\CERTIFICATE_THUMBPRINT

Use an explicit identity in production automation. This prevents a build or signing machine with several certificates from selecting an unintended signer.

Sign the PowerShell Script

Set-AuthenticodeSignature is the PowerShell cmdlet used to add an Authenticode signature to a PowerShell script. Give it the script path and the certificate object selected from the certificate provider.

Set-AuthenticodeSignature `
  -FilePath "C:\Release\Deploy-Application.ps1" `
  -Certificate $cert

The cmdlet returns signature information. Inspect that result instead of assuming the command succeeded simply because no obvious error appeared.

Add a Trusted Timestamp

For a production signing workflow that requires timestamp evidence, provide a timestamp server through -TimestampServer during the signing operation.

Set-AuthenticodeSignature `
  -FilePath "C:\Release\Deploy-Application.ps1" `
  -Certificate $cert `
  -TimestampServer "TIMESTAMP_URL"

Replace TIMESTAMP_URL with the timestamp service required by your signing setup. If the timestamp service is unavailable and timestamping is mandatory for your release, treat that as a signing failure rather than silently publishing without the required evidence.

Verify the Signed Script

Use Get-AuthenticodeSignature to inspect the signature status on the exact script you intend to distribute.

Get-AuthenticodeSignature "C:\Release\Deploy-Application.ps1" |
  Format-List *

Also inspect StatusMessage and SignerCertificate. A valid status is the starting point for release acceptance, not a substitute for checking the certificate chain and confirming that the certificate identifies the expected publisher.

Check the Signer Certificate and Timestamp

The verification object exposes the signer certificate so you can inspect the identity associated with the script signature. Check the publisher identity, certificate status, chain, and timestamp information where available.

$sig = Get-AuthenticodeSignature "C:\Release\Deploy-Application.ps1"
$sig.SignerCertificate | Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint

If the certificate is correct but the target machine does not trust the issuer, the script can have a valid cryptographic signature while still failing the trust requirement of the environment.

Test the Script Under the Intended Execution Policy

Do not stop after cryptographic verification. PowerShell's execution policy affects how scripts are allowed to run, so test the signed script in the environment where it will actually be used.

Get-ExecutionPolicy

Understand What Happens If the Script Says “Not Digitally Signed”

When PowerShell reports that a file is not digitally signed, work through the signing state first and the execution policy second. Do not assume that the certificate itself is the problem.

Possible causes include an unsigned script, a signature invalidated by editing, an untrusted certificate chain, an execution policy requiring a signature, or a signing identity that is not usable in the current environment.

Distinguish Valid Signature From Trusted Publisher

These are related but different checks. A script can carry a cryptographically valid signature while the certificate is not trusted by the target machine or does not identify the publisher you expected.

Keep these checks separate when troubleshooting. This makes it much easier to identify whether the problem is the file signature, certificate identity, trust chain, or PowerShell environment.

Do Not Modify a Signed PowerShell Script

PowerShell scripts are text files, which makes accidental post-signing edits particularly easy. Adding or removing a line, changing a variable, editing comments, changing whitespace, or simply saving a modified version can change the content covered by the signature.

The correct sequence is modify → save → test → sign again. Treat the signed script as a release artifact, not as a working source file.

Sign Multiple PowerShell Scripts

For a release directory containing several scripts, enumerate the files and sign only the scripts that belong to the release. Keep test, development, and generated temporary files outside the signing set when they are not intended for distribution.

$cert = Get-ChildItem Cert:\CurrentUser\My\CERTIFICATE_THUMBPRINT

Get-ChildItem "C:\Release\Scripts" -Filter *.ps1 -File |
  ForEach-Object {
    Set-AuthenticodeSignature `
      -FilePath $_.FullName `
      -Certificate $cert
  }

Get-ChildItem "C:\Release\Scripts" -Filter *.ps1 -File -Recurse |
  ForEach-Object {
    Set-AuthenticodeSignature `
      -FilePath $_.FullName `
      -Certificate $cert
  }

For production automation, capture the returned status for every file and fail the process if a required script does not receive the expected signature.

Sign PowerShell Scripts in CI/CD

Automated signing belongs after the script has been generated, tested, and finalized. The pipeline should never modify a signed script as part of a later packaging step.

Use an HSM or Cloud Signing Service

If the private key should not be exported to a developer workstation or build agent, move the private-key operation into a protected HSM-backed signing setup or an approved remote signing service. The PowerShell script remains the artifact being signed.

The exact integration depends on the provider. Do not assume that a remote signing service uses the same certificate-store workflow as a local certificate.