How do sign a self-signed certificate so it isn't reliable on me

Falanga, Rod, DOH 1,190 Reputation points
2026-08-19T21:26:25.18+00:00

I'm about average as a PowerShell person. But all the PowerShell I've authored as for me, specifically. I have no experience at authoring or uses PowerShell scripts to run on a Windows server, to handle tasks. Until now.

Here's my scenario. I am on a team of GitHub Administrators at work. Three years ago, I configured a Windows Server with GitHub's Self-Hosted Runner. It's been running fine ever since. When I provisioned the server, I asked for a lot of resources and was granted that request. Three years later and the server still has a lot of disk space available, etc. However, I have learned that GitHub Self-Hosted Runners do not mimic exactly how GitHub runners. Specifically, GitHub Runners, when they're done, will dispose of the files and folders they used, in the CI and CD portions of a GitHub Action. But GitHub Self-Hosted Runners do not dispose of those files and folders. Currently, our GitHub Self-Hosted Runner server still has a lot of disk space, so if nothing drastic changes it should be fine for another few years. But if the number of repos that use the Self-Hosted Runner increase, then we could have a problem sooner than current projections account for.

I have a PowerShell script for purging old copies of the files and folders that the GitHub Self-Hosted Runner uses. I tried running it on that server, but it failed telling me that I cannot run it. Long story short, I now know that I've got to digitally sign that PowerShell script. Doing more research, it appears that either we could use a CA or I could create a self-signed certificate, using what I've found on this web site PowerShell Signing Scripts: Code Sign your .ps1 Files. However, in that page it uses code snippets like this:

$certs = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert

My question deals with the CurrentUser. That would be OK if it were me, but what happens if and when I leave? Is there a way of making the scripts on that page use something other than CurrentUser?

Windows for business | Windows Server | User experience | PowerShell
0 comments No comments

Answer accepted by question author
Marcin Policht 106.8K Reputation points MVP Volunteer Moderator
2026-08-19T22:02:22.93+00:00

Yep - instead of Cert:\CurrentUser\My, you can use the Local Computer certificate store:

Cert:\LocalMachine\My

That avoids tying the certificate to your personal Windows account. For example:

Get-ChildItem

For a production server, consider using a company-issued code-signing certificate from your internal CA rather than a self-signed certificate. The certificate and private key can then be managed as an organizational resource rather than belonging to you personally.

Btw. putting the certificate in LocalMachine\My does not automatically give every account permission to use its private key. The account that signs the script must have permission to access that private key.


If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.