Set-AuthenticodeSignature
Adds an Authenticode signature to a PowerShell script or other file.
Syntax
Set-AuthenticodeSignature
[-Certificate] <X509Certificate2>
[-IncludeChain <String>]
[-TimestampServer <String>]
[-HashAlgorithm <String>]
[-Force]
[-FilePath] <String[]>
[-WhatIf]
[-Confirm]
[<CommonParameters>] Set-AuthenticodeSignature
[-Certificate] <X509Certificate2>
[-IncludeChain <String>]
[-TimestampServer <String>]
[-HashAlgorithm <String>]
[-Force]
-LiteralPath <String[]>
[-WhatIf]
[-Confirm]
[<CommonParameters>] Set-AuthenticodeSignature
[-Certificate] <X509Certificate2>
[-IncludeChain <String>]
[-TimestampServer <String>]
[-HashAlgorithm <String>]
[-Force]
-SourcePathOrExtension <String[]>
-Content <Byte[]>
[-WhatIf]
[-Confirm]
[<CommonParameters>] Description
The Set-AuthenticodeSignature cmdlet adds an Authenticode signature to any file that supports
Subject Interface Package (SIP).
In a PowerShell script file, the signature takes the form of a block of text that indicates the end of the instructions that are executed in the script. If there is a signature in the file when this cmdlet runs, that signature is removed.
Examples
Example 1 - Sign a script using a certificate from the local certificate store
These commands retrieve a code-signing certificate from the PowerShell certificate provider and use it to sign a PowerShell script.
$cert=Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
$signingParameters = @{
FilePath = 'PsTestInternet2.ps1'
Certificate = $cert
HashAlgorithm = 'SHA256'
}
Set-AuthenticodeSignature @signingParametersThe first command uses the Get-ChildItem cmdlet and the PowerShell certificate provider to get the
certificates in the Cert:\CurrentUser\My subdirectory of the certificate store. The Cert: drive
is the drive exposed by the certificate provider. The CodeSigningCert parameter, which is
supported only by the certificate provider, limits the certificates retrieved to those with
code-signing authority. The command stores the result in the $cert variable.
The second command defines the $signingParameters variable as a HashTable with the parameters
for the Set-AuthenticodeSignature cmdlet to sign the PSTestInternet2.ps1 script. It uses the
FilePath parameter to specify the name of the script, the Certificate parameter to specify
that the certificate is stored in the $cert variable, and the HashAlgorithm parameter to set
the hashing algorithm to SHA256.
The third command signs the script by splatting the parameters defined in $signingParameters.
Note
Using the CodeSigningCert parameter with Get-ChildItem only returns certificates that have
code-signing authority and contain a private key. If there is no private key, the certificates
cannot be used for signing.
Example 2 - Sign a script using a certificate from a PFX file
These commands use the Get-PfxCertificate cmdlet to load a code signing certificate. Then, use it
to sign a PowerShell script.
$cert = Get-PfxCertificate -FilePath C:\Test\Mysign.pfx
$signingParameters = @{
FilePath = 'ServerProps.ps1'
Certificate = $cert
HashAlgorithm = 'SHA256'
}
Set-AuthenticodeSignature @signingParametersThe first command uses the Get-PfxCertificate cmdlet to load the C:\Test\MySign.pfx certificate
into the $cert variable.
The second command defines the $signingParameters variable as a HashTable with the parameters
for the Set-AuthenticodeSignature cmdlet to sign the ServerProps.ps1 script. It uses the
FilePath parameter to specify the name of the script, the Certificate parameter to specify
that the certificate is stored in the $cert variable, and the HashAlgorithm parameter to set
the hashing algorithm to SHA256.
The third command signs the script by splatting the parameters defined in $signingParameters.
If the certificate file is password protected, PowerShell prompts you for the password.
Example 3 - Add a signature that includes the root authority
This command adds a digital signature that includes the root authority in the trust chain, and it is signed by a third-party timestamp server.
$signingParameters = @{
FilePath = 'C:\scripts\Remodel.ps1'
Certificate = $cert
HashAlgorithm = 'SHA256'
IncludeChain = 'All'
TimestampServer = 'http://timestamp.fabrikam.com/scripts/timstamper.dll'
}
Set-AuthenticodeSignature @signingParametersThe first command defines the $signingParameters variable as a HashTable with the parameters
for the Set-AuthenticodeSignature cmdlet to sign the script. It uses the FilePath parameter to
specify the path to the script, the Certificate parameter to specify that the certificate is
stored in the $cert variable, and the HashAlgorithm parameter to set the hashing algorithm to
SHA256. It uses the IncludeChain parameter to include all of the signatures in the trust chain,
including the root authority. It also uses the TimeStampServer parameter to add a timestamp to
the signature. This prevents the script from failing when the certificate expires.
The second command signs the script by splatting the parameters defined in $signingParameters.
Parameters
-Certificate
Specifies the certificate that will be used to sign the script or file. Enter a variable that stores an object representing the certificate or an expression that gets the certificate.
To find a certificate, use Get-PfxCertificate or use the Get-ChildItem cmdlet in the Certificate
Cert: drive. If the certificate is not valid or does not have code-signing authority, the
command fails.
| Type: | X509Certificate2 |
| Position: | 1 |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Confirm
Prompts you for confirmation before running the cmdlet.
| Type: | SwitchParameter |
| Aliases: | cf |
| Position: | Named |
| Default value: | False |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Content
This parameter appears in the syntax listing because it is defined in the base class that
Set-AuthenticodeSignature is derived from. However, support for this parameter is not implemented
in Set-AuthenticodeSignature.
| Type: | Byte[] |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-FilePath
Specifies the path to a file that is being signed.
| Type: | String[] |
| Position: | 1 |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-Force
Allows the cmdlet to append a signature to a read-only file. Even using the Force parameter, the cmdlet cannot override security restrictions.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | False |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-HashAlgorithm
Specifies the hashing algorithm that Windows uses to compute the digital signature for the file.
The default is SHA1. Files that are signed with a different hashing algorithm might not be recognized on other systems. Which algorithms are supported depends on the version of the operating system.
For a list of possible values, see HashAlgorithmName Struct.
| Type: | String |
| Position: | Named |
| Default value: | Null |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-IncludeChain
Determines which certificates in the certificate trust chain are included in the digital signature. NotRoot is the default.
Valid values are:
- Signer: Includes only the signer's certificate.
- NotRoot: Includes all of the certificates in the certificate chain, except for the root authority.
- All: Includes all the certificates in the certificate chain.
| Type: | String |
| Position: | Named |
| Default value: | NotRoot |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-LiteralPath
Specifies the path to a file that is being signed. Unlike FilePath, the value of the LiteralPath parameter is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences.
| Type: | String[] |
| Aliases: | PSPath |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-SourcePathOrExtension
This parameter appears in the syntax listing because it is defined in the base class that
Set-AuthenticodeSignature is derived from. However, support for this parameter is not implemented
in Set-AuthenticodeSignature.
| Type: | String[] |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-TimestampServer
Uses the specified time stamp server to add a time stamp to the signature. Type the URL of the time stamp server as a string.
The time stamp represents the exact time that the certificate was added to the file. A time stamp prevents the script from failing if the certificate expires because users and programs can verify that the certificate was valid at the time of signing.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
| Type: | SwitchParameter |
| Aliases: | wi |
| Position: | Named |
| Default value: | False |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Inputs
You can pipe a string that contains the file path to this cmdlet.
Outputs
This cmdlet returns a Signature object representing the value it set.
