Yes. PowerShell on Windows checks Authenticode signatures on scripts, modules and a few other file types when the execution policy is AllSigned or RemoteSigned. You sign with a code signing certificate using Set-AuthenticodeSignature, and a timestamp keeps the signature valid after the certificate expires.
What PowerShell checks
Microsoft's about_Signing page lists the file types PowerShell checks for an Authenticode signature:
- Script files with the ps1 extension
- Module files with psm1
- Module manifest and data files with psd1
- Type and format XML files with ps1xml
- CDXML script files
- XAML script files
This applies to PowerShell running on Windows. The page says the information does not apply on other platforms.
What the execution policies do
| Policy | Behavior, per Microsoft |
|---|---|
| Restricted | Does not permit any scripts to run |
| AllSigned | Prevents running scripts without a digital signature |
| RemoteSigned | Prevents running unsigned scripts downloaded from the internet, but allows local unsigned scripts |
Microsoft notes that under RemoteSigned, unsigned scripts you receive by email or messaging apps are blocked, and you can use the Unblock-File cmdlet to run one after you have reviewed the code. It stresses that scripts have the same effect as any executable program, so review before you trust.
How signing a script works
To sign, you need a code signing certificate and the Set-AuthenticodeSignature cmdlet:
$cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
Set-AuthenticodeSignature -FilePath .\deploy.ps1 -Certificate $cert
Microsoft says the cmdlet adds the signature to the script as a comment block at the end of the file, beginning and ending with a signature marker line. Because the signature is part of the file, any edit after signing breaks it, so sign as the last step of your release.
Certificates: public CA or self-signed
Microsoft describes two kinds of certificate. One comes from a certification authority that verifies your identity, and computers that trust that authority will trust your signed scripts. The other is self-signed, which is free and lets you sign and run scripts on your own computer, but a script signed that way will not run on other computers. Microsoft's guidance is that self-signed certificates are for testing and are not appropriate for scripts you want to share.
A separate post covers when self-signing is acceptable at /resources/blog/self-signed-code-signing-certificate-when-is-it-acceptable.
Protect the key
Microsoft warns that if a private key and certificate sit on a machine, malicious programs might sign scripts on your behalf, which authorizes PowerShell to run them. For a self-signed key it recommends exporting with strong protection enabled. For team signing, keep the key off ordinary workstations, as discussed in /resources/blog/where-to-keep-code-signing-keys-hardware-and-cloud-signing.
Use a timestamp
According to Microsoft, a script signature is valid until the signing certificate expires, or for as long as a timestamp server can verify that the script was signed while the certificate was valid. It adds that because most signing certificates are valid for one year, a timestamp lets users keep using your script for many years.
What a signature does not prove
A valid signature shows who signed the script and that it has not changed since. It does not show the script is safe. Microsoft's own advice is to examine each command before you sign any script you did not write.
Where Safeguard fits
Signed scripts still pull in modules and packages. Safeguard scans dependencies and builds SBOMs, with a free scan at gold.safeguard.sh/scan.
Quick check
Does a signature make a PowerShell script safe?
No. It shows the signer and that the file is unchanged. Review the code before you run or sign anything you did not write.
Why add a timestamp to a script signature?
Per Microsoft, it keeps the signature verifiable after the certificate expires, which matters because most certificates last about a year.
Sources
Last reviewed: 19 October 2026.
