Problems signing Powershell Scripts

Question

Hi world,
I'm trying to sign a powershell script with a self issued code signing certificate. I created the certificate using following command lines:
"makecert.exe" -n "CN=Code Signing Certificate Root" -a sha1 -eku 1.3.6.1.5.5.7.3.3 -r -sv "%Temp%\MakeMyCert\MyCERT.pvk" "%Temp%\MakeMyCert\MyCERT.cer" -ss Root -sr localMachine
"makecert.exe" -pe -n "CN=My Certificate" -ss MY -a sha1 -eku 1.3.6.1.5.5.7.3.3 -iv "%Temp%\MakeMyCert\MyCERT.pvk" -ic "%Temp%\MakeMyCert\MyCERT.cer"
"pvk2pfx.exe" -pvk "%Temp%\MakeMyCert\MyCERT.pvk" -pi "%Password%" -spc "%Temp%\MakeMyCert\MyCERT.cer" -pfx "%Temp%\MakeMyCert\MyCERT.pfx" -po "%Password%"
After that I try to sign my script using the MyCert.pfx file. I made sure, that the PS1 powershell script file is saved in UTF-8. I use following powershell commands (I'm asked for a Password after Get-PfxCertificate):
$cert=Get-PfxCertificate .\MyCert.pfx
Set-AuthenticodeSignature .\MyScript.ps1 -Certificate $cert
The result I get is "UnknownError", though the signature block gets written into the MyScript.ps1 file. If I read the Authenticode signature using
Get-AuthenticodeSignature .\MyScript.ps1
it still gives me the Signer Certificate followed by "UnknownError". I really don't know where to search. As mentioned before, it is not the Encoding issue. I already played around saving the PS1 file in ASCII, UTF-8, UTF-8 w/o BOM. It doesn't
make any difference.

Answer 1

I think I found the problem. Do not use pvk2pfx.exe to create your pxf file. This works in Win 7 but no longer in Win 8.1 or 2012 R2. You manually need to export the certificate including the key using certmgr.msc and save it as PFX file. Then you can use
this file with the Get-PfxCertificate commandlet.
This way it also works in Win 8.1 and Server 2012 R2.