When using Set-AuthenticodeSignature, there is an option called IncludeChain. While there is documentation about what each of the options are, I haven't been able to uncover much guidance surrounding the advantages/disadvantages of each setting (when you would pick one setting over another).
Everywhere I see IncludeChain in examples, it is always set to All. I think All is likely the best answer, but I'd like to understand the benefits and disadvantages of each of the settings.
SignerNotRoot(default)All
Other than All making the file quite a bit bigger, what are the specific advantages and disadvantages of each of the settings?
References
- https://technet.microsoft.com/en-us/library/hh847874.aspx
- http://go.microsoft.com/fwlink/?LinkID=113391
- How Can I Prevent Needing to Re-sign My Code Every 1 or 2 Years?
Example
$certPfx = "super secret location"
$certPassword = "super secret password"
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certPfx, $certPassword)
Set-AuthenticodeSignature -Filepath "ps1 file location" `
-Cert $cert `
-TimeStampServer "url to timestamp server" `
-IncludeChain All `
-HashAlgorithm SHA256