Script-Signing Errors: Troubleshooting Guide
A PowerShell script can fail because it is unsigned, its signature no longer matches the file, its certificate is not trusted, or PowerShell policy blocks execution. Diagnose those layers separately instead of treating every signing error as a certificate problem.
Common PowerShell Script-Signing Failures
Start by locating the failure stage. The same PowerShell message can lead to very different fixes depending on whether the script has no signature, the signed content changed, the signer is untrusted, or an execution policy is preventing execution.
Script cannot be signed
Look for certificate selection, private-key access, certificate-store, file-access, and timestamping problems.
Signature is invalid
Check whether the file changed after signing, whether the signature is corrupted, or whether the signing operation was incomplete.
Certificate is not trusted
Inspect the signer certificate, intermediate and root certificates, and the trust configuration of the machine or user.
PowerShell blocks execution
Check effective execution policy, Group Policy, file origin, and the signer trust decision before changing policy settings.
Certificate expired or revoked
Separate expiration before signing from expiration after signing, and consider timestamp evidence for older signatures.
CI/CD signing fails
Compare the build agent with the working machine: identity, private key, certificate store, service account, policy, and final artifact.
How to Diagnose a Script-Signing Problem
Use the same sequence for local development, deployment servers, and CI/CD. The objective is to move from a broad error such as “script won't run” to the exact property that failed.
“File Is Not Digitally Signed”
This message commonly appears when PowerShell attempts to execute a script under a policy that requires a recognized signature. First establish what is actually on disk. The file may be unsigned, the signature may have been removed, or the file being executed may not be the file that was originally signed.
Check signature presence
Use PowerShell's Authenticode inspection rather than assuming the file has the expected signature. For the signing steps themselves, see how to sign PowerShell scripts after the content is finalized.
- NotSigned means no recognized Authenticode signature is present.
- HashMismatch points to a content-integrity problem, not simply missing trust.
- NotTrusted means the signature and signer need a trust investigation.
Do not collapse different failures
An unsigned script, an invalid signature, an untrusted signer, and a restrictive execution policy are different conditions. Each requires a different diagnostic path.
Invalid Signature and Post-Signing Modification
An Authenticode signature covers the signed content. If the script changes after signing, verification can detect that the content no longer matches the signed state. A tiny edit can be enough to invalidate the signature.
Common causes of HashMismatch
- Opening and saving the script after signing
- Changing line endings or encoding
- Template substitution during deployment
- Adding configuration during packaging
- CI/CD transformations
- File corruption or an incomplete transfer
Correct production order
Anything that changes the signed script belongs before signing. If deployment must transform the file, the transformed result needs to become the artifact that is signed and verified.
Certificate and Private-Key Problems
Certificate discovery and private-key availability are related but not interchangeable. A certificate can appear in a certificate store while the corresponding private key is missing or inaccessible. The certificate identifies the signer; the private key is what permits the signing operation.
Certificate available
- Certificate is installed in the expected store
- Certificate is suitable for the intended signing purpose
- Certificate is not expired or otherwise unusable
- Signer information can be inspected
Private key available
- Certificate has an associated private key
- Current user or service account can access it
- Keychain/store permissions allow signing
- HSM or cloud provider access works when used
If the certificate is visible but signing fails, investigate the key association and access path before replacing the certificate.
Choose a certificate for PowerShell script signing
If your release process requires Authenticode signatures for PowerShell scripts, review the certificate option designed for this signing workflow.
View PowerShell Code Signing CertificatesSet-AuthenticodeSignature Errors
Set-AuthenticodeSignature performs the signing operation, so failures at this stage are usually different from errors reported later when a script is executed. Diagnose the certificate object, private key, file access, timestamp service, and execution environment separately.
| Symptom | Likely area | What to inspect first | Verification |
|---|---|---|---|
| Certificate cannot be selected | Certificate store | Certificate location, purpose, expiration | Confirm expected certificate is available |
| Signing operation fails | Private key | Key association and access permissions | Confirm the signing identity can create a signature |
| File cannot be signed | File access | Path, permissions, file lock | Sign the exact intended file |
| Timestamping fails | Timestamp service | TSA URL, connectivity, response, trust | Verify the resulting signature includes expected timestamp evidence |
| Works interactively but not in CI | Environment | Account, store, key provider, policy | Run the same inspection under the build identity |
Get-AuthenticodeSignature Status Explained
This command is one of the most useful starting points because it separates signature status from the later question of whether PowerShell will execute the script under its current policy.
| Status | What it tells you | What to check next |
|---|---|---|
| Valid | The signature is reported as valid for the inspected file. | Check signer trust, execution policy, file origin, and any higher-level controls. |
| NotSigned | No recognized Authenticode signature is present. | Confirm the correct file is being executed and sign the finalized artifact if signing is required. |
| HashMismatch | The signed content no longer matches the file being verified. | Find edits, encoding changes, deployment transformations, or corruption. |
| NotTrusted | The signer or certificate chain is not trusted in the current environment. | Inspect the signer certificate, intermediates, root, and trust stores. |
| UnknownError | The signature could not be evaluated normally. | Inspect the file, signature structure, certificate, provider, and environment. |
| NotSupportedFileFormat | The inspected file is not supported for this Authenticode operation. | Confirm the file type and use the appropriate signing or verification method. |
Certificate Chain and Trust Errors
A valid signature does not automatically mean the signer is trusted. The certificate chain provides the path from the signer certificate through any intermediate CA to a trusted root. The current machine or user environment can affect whether that chain is trusted.
- Check for a missing intermediate certificate.
- Check whether the root is trusted in the current environment.
- Compare trust stores when the same script behaves differently on two computers.
- Consider enterprise or private CA configuration separately from public CA trust.
Expired and Revoked Code Signing Certificates
Expired before signing
A certificate that is already expired is not the same situation as a certificate that expires after a signature was created.
Expired after signing
Timestamp evidence can provide important signing-time context when an older signature is evaluated after the certificate's validity period has ended. The exact validation result depends on the platform and certificate status available to the verifier.
Revoked certificate
Revocation is a different lifecycle event from expiration. It can indicate that a certificate should no longer be trusted, including situations involving key compromise. Review what happens when a code signing certificate is revoked for the broader lifecycle implications.
- Determine whether the certificate was revoked and why.
- Check the signing time and timestamp evidence.
- Assess the impact on new signing and previously distributed scripts.
- Replace affected signing credentials where required.
For broader lifecycle decisions, use the site's dedicated certificate expiration and revocation resources rather than treating this troubleshooting page as a complete certificate-lifecycle guide.
Timestamp Errors
Timestamping adds evidence about when a signature was created. In production script signing, it should be treated as part of the signing workflow rather than an optional afterthought.
Service unavailable
The timestamp server may be unreachable or temporarily unavailable. Check network access and the configured TSA endpoint.
Invalid response
A malformed or unusable timestamp response can cause signing to succeed only partially or fail at the timestamp stage.
Timestamp trust
Inspect the timestamp certificate and chain when older signatures depend on timestamp evidence for validation.
Execution Policy Errors
PowerShell execution policy is the major PowerShell-specific layer in this troubleshooting model. It controls how PowerShell handles script execution. It does not replace Authenticode signing, and it should not be presented as a complete security boundary.
Restricted
Script execution is restricted. A signing problem is not the right diagnosis if policy prevents scripts from running in the first place.
AllSigned
Scripts generally need a recognized digital signature. A signed file can still fail if its signer is not accepted or its signature is invalid.
RemoteSigned
Downloaded scripts can receive different treatment from locally created scripts, particularly when Windows records their remote origin.
Unrestricted
Execution restrictions are reduced, but file-origin and warning behavior can still matter.
Bypass
Policy checks are bypassed for the relevant invocation or scope. It should not be used as a default troubleshooting fix.
Undefined
No policy is explicitly set at that scope. Another scope or system configuration can still determine the effective behavior.
Check the full policy list before changing anything. Pay attention to machine policy, user policy, local machine, current user, and process scope, because the effective policy can be determined by a higher-priority setting.
“Running Scripts Is Disabled on This System”
Do not immediately change the execution policy. First determine which policy is active and whether Group Policy or another higher-priority configuration controls it.
Inspect the effective configuration
Get-ExecutionPolicy -List
- Identify the effective policy.
- Compare user and machine scopes.
- Check whether Group Policy is involved.
- Confirm the expected script path and file.
Then inspect the signature
If the signature reports Valid but PowerShell still refuses execution, the next investigation is policy, signer trust, file origin, or another environment-specific control.
AllSigned Errors
AllSigned makes the distinction between “the script is signed” and “PowerShell accepts the signature” especially visible. A script can be signed yet still be blocked if the signature is invalid, the signer is not trusted, or the certificate is not acceptable in the current environment.
| Condition | What to investigate |
|---|---|
| Unsigned script | Confirm the file and add a signature to the finalized script when signing is required. |
| Invalid signature | Check for post-signing edits, encoding changes, and deployment transformations. |
| Signer not trusted | Inspect the signer certificate and certificate chain in the current trust environment. |
| Certificate invalid | Check validity, revocation status, intended use, and certificate configuration. |
| Signed and valid but still blocked | Check effective policy, Group Policy, file origin, and the exact PowerShell environment. |
RemoteSigned and Downloaded Scripts
RemoteSigned introduces file-origin context into the troubleshooting process. A script created locally can behave differently after it is downloaded because Windows can record that the file originated from the internet.
Compare the file context
- Was the script downloaded or created locally?
- Does Windows have Internet-origin metadata associated with it?
- Was the file copied, extracted, or transformed after download?
- Is the signed file the same artifact that PowerShell is executing?
Do not confuse origin with signature
File origin, signature validity, signer trust, and execution policy are separate properties. A downloaded script can have a valid signature while still receiving policy treatment different from a locally created file.
Trusted Publisher Problems
“Trusted publisher” describes a trust decision associated with the signer identity. It is not simply another name for a valid signature.
Valid signature
The signature matches the signed content and can be cryptographically verified.
Valid certificate
The signer certificate itself passes the relevant validity checks.
Trusted publisher
The current environment accepts the signer or certificate chain for the operation being performed.
Enterprise environments can deliberately establish publisher or certificate trust. When a script works for one user but not another, compare certificate stores and policy configuration rather than re-signing the same file without evidence that the signature itself is wrong.
Review Windows signing certificate options
For scripts and other Windows software, choose a certificate that fits the artifact and signing process you need to support.
Explore Windows Code Signing CertificatesScript Signing Works on One Computer but Not Another
When the same signed script behaves differently, compare the environments systematically. The file may be identical while trust and policy state are not.
| Comparison | Computer A | Computer B | Why it matters |
|---|---|---|---|
| PowerShell version | Record version | Record version | Behavior and supported features can differ. |
| Execution policy | Record all scopes | Record all scopes | Policy can block an otherwise valid signature. |
| Certificate trust | Inspect chain | Inspect chain | Different trust stores can produce different results. |
| User account | Record account | Record account | Certificate stores and permissions can be user-specific. |
| Group Policy | Check | Check | Enterprise policy can override local assumptions. |
| File artifact | Compare hash/file | Compare hash/file | A transformed or different script is a different verification target. |
| File origin | Check metadata | Check metadata | Remote-origin context can affect execution behavior. |
Script Signing in CI/CD
CI/CD failures often come from environmental differences rather than from the script itself. A developer can sign interactively because the certificate, private key, and user profile are available, while a build agent runs under a service identity with none of those assumptions.
Build-agent checks
- Certificate is available to the build identity.
- Private key is accessible through the approved provider.
- Service account has required permissions.
- Certificate store is the expected store.
- Timestamp service is reachable.
Artifact checks
- Signing happens after final script generation.
- No deployment step changes the signed file.
- Signature status is checked before publication.
- The published artifact is the verified artifact.
- Execution is tested in the target environment.
HSM and Cloud Signing Troubleshooting
Hardware-protected and cloud-based signing can improve key protection, but they add another access layer. A visible certificate does not prove that the current build identity can reach the signing key.
Authentication
Confirm the CI identity is authenticated with the signing provider and has the expected permissions.
Provider access
Check provider configuration, network/API connectivity, key availability, and signing permissions.
Final verification
Inspect the completed script after signing and timestamping. A successful signing API call is not the final verification step.
Script-Signing Errors by Cause
| Symptom | Likely layer | First check |
|---|---|---|
| File is not digitally signed | Signature | Is the exact script signed? |
| NotSigned | Signature | Signature presence |
| HashMismatch | Integrity | Was the script modified? |
| NotTrusted | Trust | Certificate chain and trust store |
| Certificate not found | Certificate | Certificate store and purpose |
| Private key unavailable | Key | Certificate/key association and access |
| Execution blocked | Policy | Effective execution policy |
| AllSigned blocks script | Policy/trust | Signature plus signer trust |
| Timestamp failed | Timestamp | TSA configuration and connectivity |
| Works locally, fails in CI | Environment | Certificate, key, account, policy, artifact |
Diagnose PowerShell Signing Errors in the Right Order
When PowerShell refuses a script, use this sequence before changing policy or issuing a new certificate.
NotSigned
Confirm the correct script and signing workflow. Do not troubleshoot certificate trust until a signature exists.
HashMismatch
Find the process that changed the script after signing. Re-sign only after the final content is known.
NotTrusted
Inspect the signer certificate and chain in the environment where the script is being executed.
Valid signature but still blocked
Move to execution policy, Group Policy, file-origin metadata, PowerShell version, and environment-specific controls. This is the point where repeatedly re-signing the script is unlikely to solve the actual problem.
Example: A Valid Signature That PowerShell Still Blocks
Investigation
- Verify the signature on the exact script.
- Inspect the signer certificate.
- Check certificate trust and chain.
- Inspect the effective execution policy.
- Check whether Group Policy overrides local settings.
Continue
- Check whether the script has remote-origin metadata.
- Determine whether the failure is signing or PowerShell policy.
- Fix only the layer that failed.
- Verify execution again.
The useful conclusion may be that nothing is wrong with the signature. A policy or trust condition can block a correctly signed script, which is why the diagnostic sequence matters.
Prevent Script-Signing Failures Before Release
Before signing
- Finalize the script.
- Use an appropriate signing certificate.
- Protect the private key.
- Document the intended signing environment.
During release
- Timestamp production signatures.
- Verify with
Get-AuthenticodeSignature. - Do not transform signed scripts.
- Publish the verified artifact.
After release
- Test in the target environment.
- Control trusted publishers.
- Secure CI/CD signing access.
- Monitor certificate expiration and revocation.
Frequently Asked Questions About Script Signing
Why does PowerShell say my script is not digitally signed?
Get-AuthenticodeSignature before changing execution policy.Why does Get-AuthenticodeSignature show HashMismatch?
Why is my signed script NotTrusted?
Why does Set-AuthenticodeSignature fail?
Why does a signed script work on one computer but not another?
Why does AllSigned block my signed script?
Why does RemoteSigned block my script?
Does a PowerShell script need a code signing certificate?
Can an expired certificate still validate a signed script?
Why does changing a script after signing break the signature?
How do I check whether a PowerShell script is signed?
Get-AuthenticodeSignature .\YourScript.ps1 and inspect the status, signer certificate, and timestamp information.How do I troubleshoot script signing in CI/CD?
Related PowerShell and Code Signing Resources
PowerShell Code Signing
How PowerShell signing works, including signing commands, execution policy, release workflow, and CI/CD.
Windows Code Signing Troubleshooting
Broader Windows signing diagnostics covering certificates, SignTool, trust, SmartScreen, and release environments.
Authenticode Errors
Troubleshooting for Authenticode verification, certificate trust, and signing failures.
Compare available code signing certificates
Compare certificate options for your publisher identity and signing environment before standardizing a production workflow.
Browse All Code Signing Certificates