I am a software developer. My team encrypts the sensitive sections of our ASP.NET web.config files. aspnet_regiis.exe is used to manage the local key store, encrypt and decrypt.

I want to build a quick key-manager tool to avoid remembering its location and syntax, based on a Powershell script I found using A Well Known Search Engine. This is blocked by a domain policy:

PS H:\> Get-ExecutionPolicy

Before I request that this is changed to RemoteSigned...

If all machines on the intranet were set to RemoteSigned, could a certificate be created in the Domain CS for a hypothetical code-security team such that the certificate could not be used for SSL or other certificate-secured processes?

This would allow lowly devs to write scripts and have them signed without giving each code reviewer excess trust.

2 Answers 2


Yes. You can create a certificate that is only good for code signing. You could even autoenroll your team members for that certificate so that they get it automatically, as long as you use Active Directory Certificate Services in a domain.

enter image description here

Notice the "Code Signing" in the "Intended Purposes" column. Such a certificate would not be usable for server authentication, EFS encryption, etc. You can modify the security of that certificate template such that only certain domain users (e.g. your dev team) are eligible to receive such a certificate.

I wrote a little more about signing Powershell scripts here and here.


To expand upon Ryan's answer..

Yes, you can create a Code Signing Certificate who's only purpose is to sign AuthentiCode. And Ryan points you right at the template for it. You would have to make a certificate type from that template and have it available for enrollment, but your CA admin(s) can do that rather quickly (a couple of minutes plus whatever change control you have in place).

The next important part is to have any issued certificates published to all of your computers. This can be done via Group Policy, just add the individual certificates for every person signing code to the "Trusted Publishers" store in the computers.

Trusted Publishers Store in Group Policy Object

Again, a very quick change that your AD/GPO administrator(s) can perform in just a few minutes. The kicker is that you have to do this per-signer since the AuthentiCode trust doesn't follow trust chains. (read: the design is that you have to trust each publisher/signer individually to prevent someone from buying a cert from a trusted root and publishing the world's worst virus as trusted software)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.