How to sign your first script in 48 hours

Problem

When the task to be addressed is small, do not want to write to solve a utility, especially if you .NET programmer.
Script? Definitely Yes, but to put on the war machine running Windows third-party interpreter is very much not Christian. So why not take advantage of Windows Powershell? Ready to be honest: practically no experience with him was not, but it was too tempting to look.
The script that solves the task and was ready in 15 minutes, if you don't consider one "but". Script to call it was difficult because it was a set of instructions unsuitable to run in a script. The, from the point of view of PowerShell.

There's a rational explanation, of course, the execution of scripts is subject to certain limitations specified policy on execution of scripts. After creating the script, I was not able to implement it immediately in his car. However, the problem to be solved for the local machine temporarily changing the execution policy on Unrestricted or better RemoteSigned on the production server rises seriously.

There's always a way. It is logical that the finished script for performance to sign. The process of signature engine quite lengthy and arduous, but served as a good ground for this post.

After two days of suffering at home and in the office, present to the public a brief manual for signature scripts for PowerShell.

Solution

By default, the execution of all scripts is forbidden. For starters, you must allow only signed scripts from trusted publishers and trusted root certificate. In the session administrator Powershell:

> Set-ExecutionPolicy AllSigned

Further dances with a tambourine touch utility to create the root and personal certificates.
All certificates according to the "instructions" for signing a script

> Get-Help About_Signing

are created using the utility makecert.exe, located in %Program Files%\Microsoft SDKs\Windows\v7.0A\bin\makecert

The following two steps are performed in a normal command session:

> makecert -n "CN=PowerShell Local Certificate Root" -a sha1 -eku 1.3.6.1.5.5.7.3.3 -r-sv root.pvk root.cer -ss Root -sr localMachine

> makecert -pe -n "CN=PowerShell User" -ss MY-a sha1 -eku 1.3.6.1.5.5.7.3.3 -iv root.pvk -ic root.cer


The first line creates the root certificate using a certification authority a local machine. Most popular "free" method of obtaining of the certificate.
The second line creates a personal user certificate PowerShell to sign scripts, assuring its root certificate. If all goes well, both rows should show the result of Succeeded.

The above manipulation is possible and is not performed if a personal X509 certificate already exists.

After that, just in case, you can verify that the OS know about the newly created certificate. PowerShell:

> Get-Childitem cert:\CurrentUser\my-codesigning

To sign scripts is already possible, but in this case, the signature of the script each time will leave this line of Powershell:

> Set-AuthenticodeSignature "$ @ " @(Get-ChildItem cert:\CurrentUser\My-codesigning)[0]

It would be logical to create a script that will sign other scripts. The script should create it in any text editor, except PowerShell ISE. For scripts created within this environment will encounter problems with signing in Unknown Error. The decision, taken SDAs.

The script itself looks like this:
the param([string] $file=$(throw "Please specify a filename."))
$cert = @(Get-ChildItem cert:\CurrentUser\My-codesigning)[0]
Set-AuthenticodeSignature $file $cert

Using the instructions above, sign this script in interactive mode PowerShell.
After that, the script to execute on another machine can be signed as follows:

> .\Add-Signature.ps1 MyScript.ps1

sad

On any machine except the one on which you created the certificate:
the

If the root certificate is not trusted to run the script will fail at all.

the

If the personal certificate of the Issuer who signed the script is not trusted, the code will be executed only with confirmation.

In order to add the root and personal certificates in the trusted, you need to use admin console mmc snap Certificates. Certificates add to folder Trusted Root Certification Authorities and Trusted Publishers.

It does not claim to the only correct decision, but the results show that while it is more or less normal way. Asking knowledgeable to help clarify the situation and to point a link, if possible.

Article based on information from habrahabr.ru