trusted publisher certificate

enterprise ca has issued code signing certificate user. user signed script certificate. user wants run script on domain member workstation (i.e. workstation has entrprise ca trusted root authority), yet, powershell says publisher not trusted. ok, solution add publisher's certificate trusted publishers necessary if certificate issued authority trusted certificate issuer? example certificate authority issued exchange server trusted explicitly, no need add certificate store. expect code signing certificate behave in same way. catch?

thank you.

> certificate issued trusted root ca should trusted, no matter certificate intended (code signing or identity verification), right?

no not case digital signature certificates.

> reason why have explicitly define certificate trusted publisher?

the reason pretty simple. digital signature certificates user's certificate, not machine. means can purchase digital signature certificate (about $100+ per year) to sign data. malware writer can too. , if malware writer signs code certificate trust (without granuled trust statuses). in other words may not want explicitly trust digital signatures if certificates are issued trusted authority. similar behavior used in user logon certificates. if logon certificate issued trusted ca, ca certificate must explicitly trusted client trusted logon certificate issuer (ca certificate published in ntauthcertificates store in ad) because logon certificates means entity impersonation.

---

my weblog: http://en-us.sysadmins.lv
powershell pki module: http://pspki.codeplex.com
windows pki reference: on technet wiki

Windows Server  >  Security