创建自签名的PowerShell脚本开始完成

Question

While investigating this problem myself, I was unable to find any start-to finish solutions on self-signing PowerShell scripts. So, how do you handle it all self-contained within PowerShell itself to utilize the AllSigned Execution Policy and help secure your systems better?

Answer 1

This is a modern approach to self-signed PowerShell scripts. I found older versions of PowerShell ISE (only confirmed 2.0) will encode your scripts in Big Endian vs UTF-8 and cause issues with signing. With this method, you shouldn't run into that since we're on v4+ here.
Requirement: PoSH 4.0+.

This function will: check if a Pfx cert exists and import it to LocalMachine\\TrustedPublisher ; check if a cert was passed to it, export to a Pfx cert and import it; or create the cert to LocalMachine\\Personal , export it, and import it. I was unable to get the permissions to work with me to use the Cert:\\CurrentUser stores outside of \\My (Personal).

$ErrorActionPreference = 'Stop'

Function New-SelfSignedCertificate
{
    Param([Parameter(Mandatory=$True)]$PfxCertPath,$CertObj)

    # Creates a SecureString object
    $Cred = (Get-Credential).Password

    If (Test-Path $PfxCertPath)
    {
        Try {
          Import-PfxCertificate -FilePath $PfxCertPath -Password $Cred -CertStoreLocation Cert:\LocalMachine\TrustedPublisher
          Write "$($PfxCertPath.FriendlyName) exists and is valid. Imported certificate to TrustedPublishers"
        } Catch {
          Write "Type mismatch or improper permission. Ensure your PFX cert is formed properly."
          Write "[$($_.Exception.GetType().FullName)] $($_.Exception.Message)"
        }
    } ElseIf ($CertObj) {
        Try {
          Export-PfxCertificate -Cert $CertObj -FilePath $PfxCertPath -Password $Cred -Force
          Import-PfxCertificate -FilePath $PfxCertPath -Password $Cred -CertStoreLocation Cert:\LocalMachine\TrustedPublisher
        } Catch {
          Write "[$($_.Exception.GetType().FullName)] $($_.Exception.Message)"
        }
    } Else {
        Try {
          $DNS = "$((GWMI Win32_ComputerSystem).DNSHostName).$((GWMI Win32_ComputerSystem).Domain)"
          $CertObj = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName $DNS -Type CodeSigningCert -FriendlyName 'Self-Sign'
          Export-PfxCertificate -Cert $CertObj -FilePath $PfxCertPath -Password $Cred -Force
          Import-PfxCertificate -FilePath $PfxCertPath -Password $Cred -CertStoreLocation Cert:\LocalMachine\TrustedPublisher
        } Catch {
          Write "[$($_.Exception.GetType().FullName)] $($_.Exception.Message)"
        }
    }
}

# Can be called like:
#   Sign-Script -File C:\Script.ps1 -Certificate (GCI Cert:\LocalMachine\TrustedPublisher -CodeSigningCert)
#
# After the cert is imported to TrustedPublisher, you can use the
# exported pfx cert to sign on the machine instead of this method
Function Sign-Script
{
    Param($File,$Cert)
    If($Cert-is[String]){Try{$Cert=Get-PfxCertificate("$Cert")}Catch{}}
    Set-AuthenticodeSignature -FilePath $File -Certificate $Cert -Force
}
Function Check-SignedScript
{
    Param($File)
    Get-AuthenticodeSignature -FilePath $File 
}

After all is said and done, you can execute Set-ExecutionPolicy AllSigned as admin and use this script to sign all your scripts. Check-SignedScript will tell you if the sign is valid and you can tell if Sign-Script worked as your file will have # SIG # Begin signature block at the end. Any edits to a signed script need to be re-signed in order to execute.