# Cannot add digital signature to my script **URL:** \ **Category:** PowerShell Help\ **Created:** [July 24, 2015, 1:29am UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573 "2015-07-24T01:29:30Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![toni-kuzmanovski](https://avatars.discourse-cdn.com/v4/letter/t/7ba0ec/32.png) [@toni-kuzmanovski](https://forums.powershell.org/u/toni-kuzmanovski)\ **Post date:** [July 24, 2015, 1:29am UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573/1 "2015-07-24T01:29:30Z")
Hi everyone. I have a problem with adding digital signature to my script. I cannot figure what am I doing wrong. This are the steps that I did: - First I have created self-signed certificate: PS New-SelfSignedCertificate -DnsName test -CertStoreLocation Cert:\CurrentUser\My - Second I added certificate to variable: PS $cert = Get-Item Cert:\CurrentUser\My\7EEEB8FD2421BA55E0F0D6BEE6EF5FB03A3CF2E1 - Third I try to add certificate to the script PS Set-AuthenticodeSignature -FilePath C:\test.ps1 -Certificate $cert And I get following error: Set-AuthenticodeSignature : Cannot sign code. The specified certificate is not suitable for code signing. At line:1 char:1 - Set-AuthenticodeSignature -FilePath C:\test.ps1 -Certificate … - ```auto + CategoryInfo : InvalidArgument: (:) [Set-AuthenticodeSignature], PSArgumentException + FullyQualifiedErrorId : Argument,Microsoft.PowerShell.Commands.SetAuthenticodeSignatureCommand ``` Can someone help? ---
**Author:** ![richard-siddaway](https://avatars.discourse-cdn.com/v4/letter/r/d78d45/32.png) [@richard-siddaway](https://forums.powershell.org/u/richard-siddaway)\ **Post date:** [July 24, 2015, 1:53am UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573/2 "2015-07-24T01:53:11Z")
if you try this ls Cert:\CurrentUser\My -CodeSigningCert you won’t see any result expect Which means that New-SelfSignedCertificate doesn’t appear to create a cert you can use to sign code. Which is odd as the documentation in the help file leads you to belive yo can I’ll dig a bit more ---
**Author:** ![martin-nielsen](https://avatars.discourse-cdn.com/v4/letter/m/bbce88/32.png) [@martin-nielsen](https://forums.powershell.org/u/martin-nielsen)\ **Post date:** [July 24, 2015, 5:43am UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573/3 "2015-07-24T05:43:46Z")
Unfortunately New-SelfSignedCertificate is a very watered down cmdlet that does not support creating code signing certificates. You have three options: 1. Buy a proper code signing certificate 2. Use the makecert.exe tool - [https://msdn.microsoft.com/en-us/library/windows/desktop/jj835832(v=vs.85).aspx](https://msdn.microsoft.com/en-us/library/windows/desktop/jj835832(v=vs.85).aspx) (this guide is more indepth than just creating the certificate, but you should be able to extract the necessary information) 3. Install the Active Directory Certificate Services role on a Windows Server VM and issue yourself a code signing certificate ---
**Author:** ![richard-siddaway](https://avatars.discourse-cdn.com/v4/letter/r/d78d45/32.png) [@richard-siddaway](https://forums.powershell.org/u/richard-siddaway)\ **Post date:** [July 24, 2015, 10:19pm UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573/4 "2015-07-24T22:19:18Z")
There are instructions on using makecert to generate a self signed code signing cert in the about\_signing help file ---
**Author:** ![richard-siddaway](https://avatars.discourse-cdn.com/v4/letter/r/d78d45/32.png) [@richard-siddaway](https://forums.powershell.org/u/richard-siddaway)\ **Post date:** [July 25, 2015, 12:06am UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573/5 "2015-07-25T00:06:09Z")
You can get the makecert utility for Windows 8.1 from [Windows SDK and emulator archive | Microsoft Developer](https://msdn.microsoft.com/en-gb/windows/desktop/bg162891.aspx) You’ll find it in C:\Program Files (x86)\Windows Kits\8.1\bin\x64 or C:\Program Files (x86)\Windows Kits\8.1\bin\x86 ---
**Author:** ![toni-kuzmanovski](https://avatars.discourse-cdn.com/v4/letter/t/7ba0ec/32.png) [@toni-kuzmanovski](https://forums.powershell.org/u/toni-kuzmanovski)\ **Post date:** [July 26, 2015, 7:09pm UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573/6 "2015-07-26T19:09:11Z")
Thanks everyone for the help. ---
**Author:** ![gerard-ashton](https://avatars.discourse-cdn.com/v4/letter/g/35a633/32.png) [@gerard-ashton](https://forums.powershell.org/u/gerard-ashton)\ **Post date:** [January 15, 2016, 8:24am UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573/7 "2016-01-15T08:24:31Z")
I’m brand new at this stuff, so creating a code signing certificate for experimentation was one of the first things I had to do; I just figured this out today. Here is the command I gave, except I have faked my email address: First, in PowerShell, navigate to cert:\Currentuser\My Then give this command: CurrentUser\my\> New-SelfSignedCertificate -Subject “E=ga@nowhere.invalid,CN=Gerard Ashton” -TextExtension @(“2.5.29.37={text}1.3.6.1.5.5.7.3.3”) In the TextExtension property, 2.5.29.37 means Enhanced Key Usage, and 1.3.6.1.5.5.7.3.3 means code signing. One area I will need to explore is how hard it would be for just anyone to use this certificate; I have a feeling I should be doing more to secure it. Use this technique with due caution. Followup: once you create the certificate, you need to trust it. Navigate to Control Panel and type “certificate” in the search window. Then choose Manage User Certificates. Then go into the “Trusted Root Certification Authorities” and import the certificate you just created. You will find it in C:\Users\YourUserName\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates When you are trying to import it, be sure the file extension is set to _._ all files, because this file doesn’t have any extension. ---
**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\ **Post date:** [May 16, 2024, 8:43pm UTC](https://forums.powershell.org/t/cannot-add-digital-signature-to-my-script/4573/8 "2024-05-16T20:43:07Z")