Windows 10: Trusted Publisher - Code Signing Certificate

I am working on trying code signing on my test environment and have now created a certificate template on my CA that I can request with my user. The certificate expires after one year, but in my Powershell script I give a timestamp server when signing. So the signed script should work even after one year. But I noticed that when I start the script, I always get the message that it was not signed by a trusted publisher. So I have exported the certificate on the client and created a GPO, which imports the certificate on all clients as Trusted Publisher. Now the script works without any message

:)

 

How i make the Publisher certificate to be installed into 'Trusted Publishers' by default?

I make a certificate in PowerShell.
First is the root and second i want the Publisher.

I export the certificates to a '*.pfx' file and when i install from that, the Root is put to Root folder and is good but the Second is going to Public and not to 'Trusted Publishers'.

How i can make the second to be installed to 'Trusted Publishers' by default?

If is possible.

 

N8 certificates not trusted/don't match the name

Well I worked out for myself how to verify the certificates are genuine:

• Using a desktop computer
• Go to the page with the certificates
• Select a certificate
• It will say either:
  • Certificate already exists - this confirms that the certificate on the website matches one already in your browser, which we already trust, therefore the certificate on the website is trustworthy
  • Asks if you want to install the certificate, DON'T.
    • First view the certificate details.
    • Copy the certificate serial number or SHA1/SHA256/MD5/etc hash
    • Paste this into a search engine
    • If another website that you trust lists the certificate, e.g. your phone manufacturer or another trusted website (preferably a secure website, therefore you have confidence the website is genuine), then you can trust the certificate
    • If no trustworthy sites are returned in the search then try another hash or serial number
    • If you can't find any trustworthy sites listing the certificate then I suggest you don't trust it.
• Finally, if you decide you trust a certificate then you can download and install on your phone.