{"record":{"id":"494e7b23534d9528","repo":"PowerShell/PowerShell","slug":"the-file-0-could-not-be-signed","errorCode":null,"errorMessage":"The file {0} could not be signed.","messagePattern":"The file (.+?) could not be signed\\.","errorType":"exception","errorClass":"PSInvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.PowerShell.Commands.Utility/commands/utility/ImplicitRemotingCommands.cs","lineNumber":3103,"sourceCode":"            {\n                if (certificate == null)\n                {\n                    string message = ImplicitRemotingStrings.CertificateNeeded;\n                    throw new PSInvalidOperationException(message);\n                }\n                else\n                {\n                    string currentFile = baseName + \".psm1\";\n                    try\n                    {\n                        SignatureHelper.SignFile(SigningOption.Default, currentFile, certificate, string.Empty, null);\n                        currentFile = baseName + \".format.ps1xml\";\n                        SignatureHelper.SignFile(SigningOption.Default, currentFile, certificate, string.Empty, null);\n                    }\n                    catch (Exception e)\n                    {\n                        string message = StringUtil.Format(ImplicitRemotingStrings.InvalidSigningOperation, currentFile);\n                        throw new PSInvalidOperationException(message, e);\n                    }\n                }\n            }\n\n            result.Add(baseName + \".psd1\");\n            FileInfo manifestFile = new(baseName + \".psd1\");\n            FileStream psd1 = new(\n                manifestFile.FullName,\n                fileMode,\n                FileAccess.Write,\n                FileShare.None);\n            using (TextWriter writer = new StreamWriter(psd1, encoding))\n            {\n                GenerateManifest(writer, baseName + \".psm1\", baseName + \".format.ps1xml\");\n                psd1.SetLength(psd1.Position);\n            }\n\n            PSPrimitiveDictionary applicationArguments = GetApplicationArguments();","sourceCodeStart":3085,"sourceCodeEnd":3121,"githubUrl":"https://github.com/PowerShell/PowerShell/blob/3ff3c711bf54a18f8440f3c5190c3ac91cdc5852/src/Microsoft.PowerShell.Commands.Utility/commands/utility/ImplicitRemotingCommands.cs#L3085-L3121","documentation":"Thrown by Export-PSSession when signing the generated psm1 or format.ps1xml file fails for any reason. SignatureHelper.SignFile is wrapped in a try/catch that catches a generic Exception and re-throws it as PSInvalidOperationException with the failing filename, preserving the original exception as the inner exception.","triggerScenarios":"Passing a -Certificate that exists in the store but is not a valid code-signing certificate, is expired/revoked, lacks a private key, or cannot write the signature to the file (path locked, read-only, missing permissions).","commonSituations":"Selecting a non-code-signing cert (e.g. an SSL/TLS cert) from the store; expired or not-yet-valid certificates; files held open by antivirus or another process; the cert's private key is not exportable/accessible to the current user.","solutions":["Inspect the inner exception to find the underlying SignFile failure (e.g. CryptographicException) for the real cause","Verify the certificate is a code-signing cert with HasPrivateKey and a Valid EnhanceKeyUsage (Code Signing), and is within its validity period","Ensure the generated psm1/format.ps1xml files are writable and not locked by another process","Re-run with a fresh cert issued specifically for code signing"],"exampleFix":"# before\nExport-PSSession -Session $s -OutputModule MyMod -Certificate $tlsCert\n\n# after\n$signCert = Get-ChildItem Cert:\\CurrentUser\\My -CodeSigningCert |\n    Where-Object { $_.NotAfter -gt (Get-Date) -and $_.HasPrivateKey }\nExport-PSSession -Session $s -OutputModule MyMod -Certificate $signCert","handlingStrategy":"try-catch","validationCode":"$cert = Get-ChildItem Cert:\\CurrentUser\\My -CodeSigningCert |\n  Where-Object { $_.HasPrivateKey -and $_.NotAfter -gt (Get-Date) }\nif (-not $cert) { throw 'No valid code-signing cert available.' }","typeGuard":"null","tryCatchPattern":"try { Export-PSSession -Certificate $cert @params } catch [System.Management.Automation.PSInvalidOperationException] { $inner = $_.Exception.InnerException; Write-Error \"Signing failed: $($inner.Message)\" }","preventionTips":["Pre-validate the cert is a non-expired code-signing cert with a private key","Ensure generated module files are not locked by AV or another process before signing"],"tags":["signing","implicit-remoting","certificate","export-pssession"],"backgroundTag":null,"analyzedSha":"3ff3c711bf54a18f8440f3c5190c3ac91cdc5852","analyzedAt":"2026-08-13T10:39:10.759Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}