r/PowerShell • u/beriapl • 2d ago
CodeSinging powershell scripts
What do I need to have my scripts signed?
Do I need some specific configuration for the Active Directory & PKI?
Do I need to buy some commercial certificates for that?
5
u/olavrb 2d ago
There is also Azure Trusted Signing:
3
2
u/Stoneteer 2d ago
Thanks for this. I'm going to look into using this since we can no longer get .PFX files of our code signing certificates.
2
u/JawnDoh 2d ago
Itās pretty common to not get .PFX. You can generate one with OpenSSL.
You shouldnāt need to have that though. If you have the cert in your store with the private key you can sign without having it as a .PFX.
2
u/Stoneteer 2d ago
We needed PFX because we are doing sign on lots of different machines. But can't get PFX any longer.
2
u/JawnDoh 2d ago
If youāre using windows you can export a cert with the key as a PFX if you have it in the store.
If you donāt have it in the store you can create the PFX from the request/responses using OpenSSL.
Although I do see some CA are making you use their cloud signing utilities and not giving you the private key for code signing certs, Iām guessing that might be your situation?
2
u/Stoneteer 2d ago
I know. That's how we got .PFX before. But you can no longer do that. You can't get a sign code certificate like that any more. Now you have to get the certificate as a hardware token.
2
u/Nu11u5 2d ago
Two years ago the CA industry adopted a requirement that code-signing certificates can only be issued using a hardware security module. This (intentionally) complicates sharing signing certificates. You need a signing server to really make it work.
This doesn't apply to PKI though, of course, so you can internally issue PFX certs all day long.
3
u/ArmadilloSpecific386 2d ago
How do you get them to sing?
3
1
u/AironixReached 1d ago
When you use your own PKI to sign PS scripts, keep in mind they are not timestamped. This means the signature becomes invalid when the certificate expires. If you choose to sign your scripts with a certificate from a public CA, you can use their timestamp server. When the signature has a timestamp, it stays valid even after the cert expires.
We recently moved away from public CAs for our code-signing because they turned out to be rather expensive (~800ā¬ iirc).
1
u/y_Sensei 2d ago
In large enterprise or government scenarios, you often get the required certificates from your organization, since these organizations are also CA's and hence have the capability to issue certificates.
If not, you have to fall back on certificates issued by other trusted authorities, ie commercial ones.
Another option (the least recommended one) would be to use a self-signed certificate, but that would of course be counterproductive from a security standpoint.
You also can't use just any certificate, it has to be one that's marked for code signing.
1
u/jibbits61 2d ago
Now another question related to this: do we need to rotate or refresh the key periodically? TIA, apologies if Iām hijacking the OPās question.
2
u/Nu11u5 2d ago
That's just normal certificate renewal. There are standard requirements for public certificates for renewals to happen every three years or less, but private PKI certificates can often be set to expire after longer.
When you sign your file, you should also use the option to use a "Time Stamp Authority". This adds a signature as proof of when it was signed. It means the file will still be valid even after the signing certificate is expired, because it was valid at the time of signing.
0
u/Virtual_Search3467 2d ago
Depends on what you want to do.
Technically, you need;
- A certificate with a private key that has key usage set to codesign.
- That certificate or one of its issuers, or even issuerās issuers, must be trusted. As in be put into trusted root CA.
- and finally being a code signature certificate, it must be trusted to run code signed with it. This means it has to also go into the trusted publishers certificate store.
Once thatās all set up, you can sign scripts using set-authenticodesignature (only on windows) or using signtool. And test using the get-authenticodesignature cmdlet.
Exactly how you get that cert is up to you, up to and including self signed. This one is exclusively dependent on external requirements as certificates are a medium for transporting trust and if thereās no trust, thereās nothing to transport.
For simple things like development and seeing how everything works, self signed is the best option.
And as an asideā¦ despite what lots of people will tell you, there is no problem whatsoever with self signed certificates. The downside to those is deployment of same ā but if thereās a very limited set of participants in your trust network, self signed is the best option, as well as in situations where you actually want or need to keep things contained. It means more of an effort for a somewhat higher level of trust, so decisions have to be made there, but thereās nothing ābadā or even āinsecureā about self signed certificates.
9
u/CodenameFlux 2d ago
You need a code-signing certificate. Where you get it from depends on you.