2

Completely new to certificate usage so be gentle.

I'd like to deploy Powershell scripts that I made to other employee computers so they can use them, but I will need to sign them in order for them to run as default execution policy is RemoteSigned. We are unfortunately not on a AD domain.

My current approach is to have an install script with an exported self-signed CER certificate file included to install the script to their computer and add the certificate to the appropriate cert stores. This has some limitations though (e.g. no extended properties).

Is this sufficient, or do I have to go signed by a CA and cough up dough yearly?

Improve this question
4
  • 1
    I think this question is better suited for superuser.com – ρss Jun 19 '15 at 15:30
  • There are numerous blogs walking you through the signing process. – schroeder Jun 19 '15 at 20:42
  • Using self-signed certificates is a terrible idea from a security perspective. There is no "proper" way to do this. – Greg Askew Jun 22 '15 at 15:10
  • if your execution policy is RemoteSigned you don't have to sign your scripts to use them internally. In the worst case you have to unblock the script files. – Peter Hahndorf Jun 22 '15 at 16:33
0

As others have mentioned in the comments, the best way is to get a certificate from your internal certificate server (Active Directory Certificate Services or similar).

If the internal certificate authority isn't an option, the next best is to get a certificate from a reputable certificate provider (Verisign, Thawte, etc.).

The last option is to create a self-signed certificate. With this option you'll need to reach out to each system where the script will run and configure it to trust the certificate. Should the certificate need to be revoked, you'll need to reach out to each system again so it's no longer trusted.

This TechNet Magazine article has a great explanation.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy