Set-AuthenticodeSignature

Set-AuthenticodeSignature
    [-Certificate] <X509Certificate2>
    [-FilePath] <String[]>
    [-IncludeChain <String>]
    [-TimestampServer <String>]
    [-HashAlgorithm <String>]
    [-Force]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Set-AuthenticodeSignature
    [-Certificate] <X509Certificate2>
    -LiteralPath <String[]>
    [-IncludeChain <String>]
    [-TimestampServer <String>]
    [-HashAlgorithm <String>]
    [-Force]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Set-AuthenticodeSignature
    [-Certificate] <X509Certificate2>
    -SourcePathOrExtension <String[]>
    -Content <Byte[]>
    [-IncludeChain <String>]
    [-TimestampServer <String>]
    [-HashAlgorithm <String>]
    [-Force]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

The Set-AuthenticodeSignature cmdlet adds an Authenticode signature to any file that supports Subject Interface Package (SIP).

In a PowerShell script file, the signature takes the form of a block of text that indicates the end of the instructions that are executed in the script. If there is a signature in the file when this cmdlet runs, that signature is removed.

These commands retrieve a code-signing certificate from the PowerShell Certificate provider and use it to sign a PowerShell script.

$cert=Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
$signingParameters = @{
    FilePath      = 'PsTestInternet2.ps1'
    Certificate   = $cert
    HashAlgorithm = 'SHA256'
}
Set-AuthenticodeSignature @signingParameters

The first command uses the Get-ChildItem cmdlet and the PowerShell Certificate provider to get the certificates in the Cert:\CurrentUser\My subdirectory of the certificate store. The Cert: drive is the drive exposed by the Certificate provider. The CodeSigningCert parameter, which is supported only by the Certificate provider, limits the certificates retrieved to those with code-signing authority. The command stores the result in the $cert variable.

The second command defines the $signingParameters variable as a HashTable with the parameters for the Set-AuthenticodeSignature cmdlet to sign the PSTestInternet2.ps1 script. It uses the FilePath parameter to specify the name of the script, the Certificate parameter to specify that the certificate is stored in the $cert variable, and the HashAlgorithm parameter to set the hashing algorithm to SHA256.

The third command signs the script by splatting the parameters defined in $signingParameters.

These commands use the Get-PfxCertificate cmdlet to load a code signing certificate. Then, use it to sign a PowerShell script.

$cert = Get-PfxCertificate -FilePath C:\Test\Mysign.pfx
$signingParameters = @{
    FilePath      = 'ServerProps.ps1'
    Certificate   = $cert
    HashAlgorithm = 'SHA256'
}
Set-AuthenticodeSignature @signingParameters

The first command uses the Get-PfxCertificate cmdlet to load the C:\Test\MySign.pfx certificate into the $cert variable.

The second command defines the $signingParameters variable as a HashTable with the parameters for the Set-AuthenticodeSignature cmdlet to sign the ServerProps.ps1 script. It uses the FilePath parameter to specify the name of the script, the Certificate parameter to specify that the certificate is stored in the $cert variable, and the HashAlgorithm parameter to set the hashing algorithm to SHA256.

The third command signs the script by splatting the parameters defined in $signingParameters.

If the certificate file is password protected, PowerShell prompts you for the password.

This command adds a digital signature that includes the root authority in the trust chain, and it's signed by a third-party timestamp server.

$signingParameters = @{
    FilePath      = 'C:\scripts\Remodel.ps1'
    Certificate   = $cert
    HashAlgorithm = 'SHA256'
    IncludeChain  = 'All'
    TimestampServer = 'http://timestamp.fabrikam.com/scripts/timstamper.dll'
}
Set-AuthenticodeSignature @signingParameters

The command uses the FilePath parameter to specify the script being signed and the Certificate parameter to specify the certificate that's saved in the $cert variable. It uses the IncludeChain parameter to include all of the signatures in the trust chain, including the root authority. It also uses the TimeStampServer parameter to add a timestamp to the signature. This prevents the script from failing when the certificate expires.

The second command signs the script by splatting the parameters defined in $signingParameters.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

You can pipe a string that contains the file path to this cmdlet.

This cmdlet returns a Signature object representing the value it set.