We wrapped the details in an easy-to-use function called New-CodeSigningCert which can create new code-signing certs in your personal certificate store, or also return the newly created certificates as pfx files.
function New-CodeSigningCert { [CmdletBinding(DefaultParametersetName="__AllParameterSets")] param ( [Parameter(Mandatory)] [String] $FriendlyName, [Parameter(Mandatory)] [String] $Name, [Parameter(Mandatory,ParameterSetName="Export")] [SecureString] $Password, [Parameter(Mandatory,ParameterSetName="Export")] [String] $FilePath, [Switch] $Trusted ) $cert = New-SelfSignedCertificate -KeyUsage DigitalSignature -KeySpec Signature -FriendlyName $FriendlyName -Subject "CN=$Name" -KeyExportPolicy ExportableEncrypted -CertStoreLocation Cert:\CurrentUser\My -NotAfter (Get-Date).AddYears(5) -TextExtension @('2.5.29.37={text}1.3.6.1.5.5.7.3.3') if ($Trusted) { $Store = New-Object system.security.cryptography.X509Certificates.x509Store("Root", "CurrentUser") $Store.Open("ReadWrite") $Store.Add($cert) $Store.Close() } $parameterSet = $PSCmdlet.ParameterSetName.ToLower() if ($parameterSet -eq "export") { $cert | Export-PfxCertificate -Password $Password -FilePath $FilePath $cert | Remove-Item explorer.exe /select,$FilePath } else { $cert } }
Here is how you create a code-signing certificate as pfx file:
PS> New-CodeSigningCert -FriendlyName 'Tobias Code-Signing Test Cert' -Name TobiasCS -FilePath "$home\desktop\myCert.pfx"
You will be prompted for a password that is used to protect the pfx file. Remember the password, you’ll need it when you import the pfx file later.
And here is how you create a code-signing certificate in your personal certificate store:
PS> New-CodeSigningCert -FriendlyName 'Tobias Code-Signing Test Cert' -Name TobiasCS -Trusted
With this call, your certificate now resides on your cert: drive, and you can view it like so:
PS C:\> dir Cert:\CurrentUser\my
Likewise, you can manage it by opening your certificate store:
PS C:\> certmgr.msc
Join us in the following tips to see what you now can do with your code-signing cert!
Note that self-signed certificates are not considered trustworthy unless they are copied to the container for trusted root authorities. This is done automatically for you when you use the –Trusted switch parameter.
