CmdID / PowerShell / Cmdlets / Set
Set-AuthenticodeSignature
Adds an Authenticode signature to a PowerShell script or other file. PowerShell reference
From the PowerShell reference 11 parameters
What it does
Adds an Authenticode signature to a PowerShell script or other file. The Set-AuthenticodeSignature cmdlet adds an Authenticode signature to any file that supports Subject Interface Package (SIP). In a PowerShell script file, the signature takes the form of a block of text that indicates the end of the instructions that are executed in the script. If there is a signature in the file when this cmdlet runs, that signature is removed.
Set-AuthenticodeSignature [-Certificate] <X509Certificate2> [-IncludeChain <String>] [-TimestampServer <String>] [-HashAlgorithm <String>] [-Force] [-FilePath] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]Set-AuthenticodeSignature [-Certificate] <X509Certificate2> [-IncludeChain <String>] [-TimestampServer <String>] [-HashAlgorithm <String>] [-Force] -LiteralPath <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]Set-AuthenticodeSignature [-Certificate] <X509Certificate2> [-IncludeChain <String>] [-TimestampServer <String>] [-HashAlgorithm <String>] [-Force] -SourcePathOrExtension <String[]> -Content <Byte[]> [-WhatIf] [-Confirm] [<CommonParameters>]Example 1 - Sign a script using a certificate from the local certificate store
$cert=Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
$signingParameters = @{
FilePath = 'PsTestInternet2.ps1'
Certificate = $cert
HashAlgorithm = 'SHA256'
}
Set-AuthenticodeSignature @signingParametersIdentifyExample 2 - Sign a script using a certificate from a PFX file
$cert = Get-PfxCertificate -FilePath C:\Test\Mysign.pfx
$signingParameters = @{
FilePath = 'ServerProps.ps1'
Certificate = $cert
HashAlgorithm = 'SHA256'
}
Set-AuthenticodeSignature @signingParametersIdentifyExample 3 - Add a signature that includes the root authority
$signingParameters = @{
FilePath = 'C:\scripts\Remodel.ps1'
Certificate = $cert
HashAlgorithm = 'SHA256'
IncludeChain = 'All'
TimestampServer = 'http://timestamp.fabrikam.com/scripts/timstamper.dll'
}
Set-AuthenticodeSignature @signingParametersIdentifyIts page in the reference: Set-AuthenticodeSignature.
Parameters
-CertificateSpecifies the certificate that will be used to sign the script or file. Enter a variable that stores an object representing the certificate or an expression that gets the certificate.
To find a certificate, use Get-PfxCertificate or use the Get-ChildItem cmdlet in the Certificate Cert: drive. If the certificate isn't valid or doesn't have code-signing authority, the command fails.-ContentThis parameter appears in the syntax listing because it's defined in the base class that
Set-AuthenticodeSignature is derived from. However, support for this parameter isn't implemented
in Set-AuthenticodeSignature.-FilePathSpecifies the path to a file that's being signed.-ForceAllows the cmdlet to append a signature to a read-only file. Even using the Force parameter, the cmdlet can't override security restrictions.-HashAlgorithmSpecifies the hashing algorithm that Windows uses to compute the digital signature for the file.
The default is SHA1. Files that are signed with a different hashing algorithm might not be recognized on other systems. Which algorithms are supported depends on the version of the operating system.
For a list of possible values, see HashAlgorithmName struct.-IncludeChainDetermines which certificates in the certificate trust chain are included in the digital signature. NotRoot is the default.
Valid values are:
- Signer: Includes only the signer's certificate.
- NotRoot: Includes all of the certificates in the certificate chain, except for the root
authority.
- All: Includes all the certificates in the certificate chain.-LiteralPathSpecifies the path to a file that's being signed. Unlike FilePath, the value of the LiteralPath parameter is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences.-SourcePathOrExtensionThis parameter appears in the syntax listing because it's defined in the base class that
Set-AuthenticodeSignature is derived from. However, support for this parameter isn't implemented
in Set-AuthenticodeSignature.-TimestampServerUses the specified time stamp server to add a time stamp to the signature. Type the URL of the time stamp server as a string. The URL must start with http://.
The time stamp represents the exact time that the certificate was added to the file. A time stamp prevents the script from failing if the certificate expires because users and programs can verify that the certificate was valid at the time of signing.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.