Windows 10: How to sign Powershell profile w/ self-signed certificate?

About self-signing drivers: check in with Fernando (Dieter, the owner/operator) at Win-RAID.com. He's been doing that for years because of all the driver mods he posts on his site. Once you load his certificate, you can also load and use any of his drivers. It's a fair amount of work (with some expense for obtaining and maintaining a certificate) but it can indeed be done.
HTH,
--Ed--

 

I currently have my execution-policy set to AllSigned. I don't want to change it or bypass that restriction.

When I created my profile script--or whatever it's called--I wanted to do so in order to set permanent aliases.

For whatever reason, Microsoft has made it an ever increasingly difficult endeavor just to create permanent aliases.

The problem now is that it won't run the script because it isn't digitally signed.

I attempted to make a self-signed certificate to sign the blasted thing but I never got anywhere.

I've looked at a few guides online but they all assume I'm in a server environment or something (which means the steps keep changing or involve unnecessary steps).

In the end, I wound up with a code-signing cert and the thing is in my current-user cert store.

I'm trying to get this to work on my Windows 10 Pro desktop but I haven't a clue as to what I'm actually supposed to be doing.

Is it even possible to get what I'm asking for? *Confused

P.S. - I have no experience with either Powershell or certificates. The only reason I know what I've mentioned so far is because I spent 2-3 minutes glossing over the help files. My knowledge of PKI has me understanding that you need a private key to sign something, but I can't even get the certificate to validate my own key so it's kind of getting me flustered at this point.

:)

 

can not log in to corporate mail server

If you're using self-signed certificates, you need to manually import the certificate to your phone. Windows Phone does not automatically import self-signed certificate for security reasons, unlike iOS and Android since self-signed certificates are often
used in spoofing.

 

6680 CA certificates

You should have two certificates. One is the self-signed certificate, and one is the root CA certificate that you used to sign the self-signed certificate. Put them both in the same .crt file in that order, upload them to your server and tell Apache to
use that certificate file.

If that doesn't work, by all means try uploading it to your phone, but I suspect that if it still doesn't work then the phone just doesn't like self-signed certificates.

 

See Option Two in this tutorial to allow local scripts to run without signing: Change PowerShell Script Execution Policy in Windows 10 Windows 10 Tutorials

Screenshot from said tutorial:

 

That's what I said.

And that's what you said.

Is there any way to run the script without bypassing the execution-policy restriction? I'd rather not change it.

 

You seem not to understand what different execution polices are and do? RemoteSigned is exactly as AllSigned, only exception being that your own local scripts will not need to be signed.

it is of course up to you to choose between the easy way which does what you want, or the more difficult way and try to find a valid method to sign your own scripts.

You can even keep AllSigned for all other user accounts and only allow your own user account to run your local scripts:

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser

With -Scope CurrentUser you can set different execution policy for each user, including built-in admin.

 

@Kari

I get what the RemoteSigned execution policy does but I want to sign my script and keep the AllSigned restriction.

Is that even possible? I'd like to think it does but every tutorial I come across keeps telling me a different story.

I'll keep trying on my end but I'll eventually have to put up something.

 

It is possible! Hold on to your hat...this will take a while to explain...

...to be continued...

STATUS UPDATE: Writing step by step tutorial with pictures and verifying that everything I say works. Will post here once it's done.

 

Nice work, SliceNDice! Can't wait for the "next thrilling installment."
--Ed--

 

Thanks a lot! *Smile

 

@slicendice

Yep, that would do it. Ditto on the work well done--you cooked 'em!

I initially wanted to avoid using makecert and just use Powershell but all of my other attempts failed, so....

Thank-you! *Smile

 

You're welcome.

The information available on the interwebs is rather cryptic. I am still trying to find a decent solution for using PowerShell only.

 

Excellent job! Next, do you know how (if we can) self-sign drivers?

 

Thanks!

Hmmm...that was an excellent question. I don't know, never tried it, since I don't develop drivers. Maybe I should, now that it seems the Windows BT stack could be a bit broken (or then just protocols are missing) in RS4 and there always seems to be issues with Intel and NVidia drivers. *Wink

Edit: According to MS and other sources, these certificates should be enough for self-signing drivers too.