Script Signing, under Tools, lets any signed-in user upload a PowerShell .ps1 file and get back an Authenticode-signed copy without ever handling a code-signing certificate or its private key themselves. CertOps generates the signing key and the certificate request on the server, gets it issued, signs the script, and hands back the signed file — the user only ever sees the .ps1 going in and coming out. It is not edition-gated: a Free installation gets the same tool as a Pro one.
How it works
A user picks a code-signing-capable template — one that is active and carries the Code Signing extended key usage (1.3.6.1.5.5.7.3.3) — and CertOps generates a key pair and builds the certificate signing request itself, then submits it through the ordinary enrolment pipeline as a manually-submitted request. That request is treated exactly like any other enrolment: it can auto-issue if a matching approval rule says so, but the built-in Code Signing template currently requires approval, so in practice a request sits in Manual Approvals until someone acts on it. Once the certificate is issued, the server Authenticode-signs the uploaded script with it and the signed file becomes available to download.
The review workflow
A submission moves through three states: pending approval, signed, or — if the enrolment is rejected — gone, with the generated key discarded rather than left behind unused. The requester can check status or download the signed file at any time; asking either one also re-checks whether the underlying enrolment has since been approved, so there’s no separate “refresh” step to run first.
Who approves
Approval follows the same rules as any other certificate request: whoever holds the Admin or Approver role can act on it from Manual Approvals, the same queue every other pending enrolment waits in. Nothing about script signing gets its own approval path or its own reviewer group — a script-signing request is, to the approval engine, indistinguishable from any other manually submitted CSR against that template.
Limits
A signed script still counts against the certificate cap that applies to the account. The code-signing certificate behind it is issued the same way any other certificate is, so on a Free installation running against its certificate limit, a script-signing submission is refused with the same licence-cap response as any other enrolment attempt.
The script itself is never inspected for content. Signing proves who submitted the request and that it passed approval — it says nothing about what the script does. Authenticode here is an identity and integrity control, and reviewing what the script actually does stays a separate step you run yourself.