Signing a script is done by using the
Set-AuthenticodeSignature-cmdlet and a code-signing certificate.
#Get the first available personal code-signing certificate for the logged on user $cert = @(Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert) #Sign script using certificate Set-AuthenticodeSignature -Certificate $cert -FilePath c:\MyScript.ps1
You can also read a certificate from a
$cert = Get-PfxCertificate -FilePath "C:\MyCodeSigningCert.pfx"
The script will be valid until the cetificate expires. If you use a timestamp-server during the signing, the script will continue to be valid after the certificate expires. It is also useful to add the trust chain for the certificate (including root authority) to help most computers trust the certificated used to sign the script.
Set-AuthenticodeSignature -Certificate $cert -FilePath c:\MyScript.ps1 -IncludeChain All -TimeStampServer "http://timestamp.verisign.com/scripts/timstamp.dll"
It's recommended to use a timestamp-server from a trusted certificate provider like Verisign, Comodo, Thawte etc.