1

Do I need to sign every Powershell script (external .ps1 file) that I include in my Powershell profile? If so, can I sign it with the same certificate (or is that a worst practice)?

And just to be clear if a script changes, I only need to resign the script that changed correct? Because the content of the script is some how encoded into the signature through a checksum of some sort.

2

Do I need to sign every Powershell script (external .ps1 file) that I include in my Powershell profile?

Assuming an Execution Policy of 'AllSigned' or 'RemoteSigned', then yes, you will need to sign all scripts. Importing an external script via your profile is the same as executing (or sourcing) the PS1 file.

If so, can I sign it with the same certificate (or is that a worst practice)?

You should be signing all scripts you create with the same certificate -- your signing certificate. The signing certificate issued to you is what identifies you as the publisher of the signed scripts.

And just to be clear if a script changes, I only need to resign the script that changed correct?

You only need to re-sign scripts when you have modified the scripts. You should re-sign them with your signing cert. If you find a script has been modified, unbeknownst to you, you should identify the source of modification to determine if it was expected or not.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.