|
| 1 | +--- |
| 2 | +title: Signing CI Policies #Required; page title is displayed in search results. Include the brand. |
| 3 | +description: Learn how to sign new CI policies with Trusted Signing. #Required; article description that is displayed in search results. |
| 4 | +author: microsoftshawarma #Required; your GitHub user alias, with correct capitalization. |
| 5 | +ms.author: rakiasegev #Required; microsoft alias of author; optional team alias. |
| 6 | +ms.service: azure-code-signing #Required; service per approved list. slug assigned by ACOM. |
| 7 | +ms.topic: how-to #Required; leave this attribute/value as-is. |
| 8 | +ms.date: 04/04/2024 #Required; mm/dd/yyyy format. |
| 9 | +ms.custom: template-how-to-pattern #Required; leave this attribute/value as-is. |
| 10 | +--- |
| 11 | + |
| 12 | +# Sign CI Policies with Trusted Signing |
| 13 | + |
| 14 | +To sign new CI policies with the service first install several prerequisites. |
| 15 | + |
| 16 | + |
| 17 | +Prerequisites: |
| 18 | +* A Trusted Signing account, Identity Validation, and Certificate Profile. |
| 19 | +* Ensure there are proper individual or group role assignments for signing (“Trusted Signing Certificate Profile Signer” role). |
| 20 | +* [Azure PowerShell on Windows](https://learn.microsoft.com/en-us/powershell/azure/install-azps-windows?view=azps-9.7.1&tabs=powershell&pivots=windows-msi) installed |
| 21 | +* [Az.CodeSigning](https://learn.microsoft.com/en-us/powershell/module/az.codesigning/?view=azps-11.4.0) module downloaded |
| 22 | + |
| 23 | +Overview of steps: |
| 24 | +1. Unzip the Az.CodeSigning module to a folder |
| 25 | +2. Open Windows PowerShell [PowerShell 7](https://github.com/PowerShell/PowerShell/releases/latest) |
| 26 | +3. In the Az.CodeSigning folder, run |
| 27 | +```Import-Module .\Az.CodeSigning.psd1 |
| 28 | +``` |
| 29 | +4. Optionally you can create a `metadata.json` file: |
| 30 | +``` |
| 31 | +Endpoint "https://scus.codesigning.azure.net/" |
| 32 | +CodeSigningAccountName "youracsaccount" |
| 33 | +CertificateProfileName "youracscertprofile" |
| 34 | +``` |
| 35 | +5. [Get the root certificate](https://learn.microsoft.com/en-us/powershell/module/az.codesigning/get-azcodesigningrootcert?view=azps-11.4.0) to be added to the trust store |
| 36 | +``` |
| 37 | +Get-AzCodeSigningRootCert -AccountName TestAccount -ProfileName TestCertProfile -EndpointUrl https://xxx.codesigning.azure.net/ -Destination c:\temp\root.cer |
| 38 | +``` |
| 39 | +Or using a metadata.json |
| 40 | +``` |
| 41 | +Get-AzCodeSigningRootCert -MetadataFilePath C:\temp\metadata.sample.scus.privateci.json https://xxx.codesigning.azure.net/ -Destination c:\temp\root.cer |
| 42 | +``` |
| 43 | +6. To get the EKU (Extended Key Usage) to insert into your policy: |
| 44 | +``` |
| 45 | +Get-AzCodeSigningCustomerEku -AccountName acstestcanary -ProfileName acstestcanaryCert1 -EndpointUrl https://xxx.codesigning.azure.net/ |
| 46 | +``` |
| 47 | +Or |
| 48 | + |
| 49 | +``` |
| 50 | +Get-AzCodeSigningCustomerEku -MetadataFilePath C:\temp\metadata.sample.scus.privateci.json |
| 51 | +``` |
| 52 | +7. To sign your policy, you run the invoke command: |
| 53 | +``` |
| 54 | +Invoke-AzCodeSigningCIPolicySigning -accountName acstestcanary -profileName acstestcanaryCert1 -endpointurl "https://xxx.codesigning.azure.net/" -Path C:\Temp\defaultpolicy.bin -Destination C:\Temp\defaultpolicy_signed.bin -TimeStamperUrl: http://timestamp.acs.microsoft.com |
| 55 | +``` |
| 56 | + |
| 57 | +Or use a `metadata.json` file and the following command: |
| 58 | + |
| 59 | +``` |
| 60 | +Invoke-AzCodeSigningCIPolicySigning -MetadataFilePath C:\temp\metadata.sample.scus.privateci.json -Path C:\Temp\defaultpolicy.bin -Destination C:\Temp\defaultpolicy_signed.bin -TimeStamperUrl: http://timestamp.acs.microsoft.com |
| 61 | +``` |
| 62 | + |
| 63 | +## Creating and Deploying a CI Policy |
| 64 | + |
| 65 | +For steps on creating and deploying your CI policy refer to: |
| 66 | +* [Use signed policies to protect Windows Defender Application Control against tampering](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-signed-policies-to-protect-wdac-against-tampering) |
| 67 | +* [Windows Defender Application Control design guide](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-design-guide) |
| 68 | + |
0 commit comments