Authenticode signature status changes to HashMismatch

Incident 1 min read Troubleshooting walkthrough

Work the problem

A signed script was edited

Fictional case: A released script had a valid signature. After a one-line configuration edit, its signature status is HashMismatch.

What should happen before this script is distributed?

Reasoning notebook

Record the evidence that supports your answer and the check you would run next. Your notes stay in this browser — nothing is uploaded.

Your hypothesis and reasoning

Why it happens

The file bytes changed after signing. Even a harmless edit, encoding conversion or line-ending rewrite invalidates the signature because the signed hash no longer matches the file.

Check this first

1PS> Get-AuthenticodeSignature -LiteralPath '.\script.ps1' | Format-List Status,StatusMessage,SignerCertificate

What to look for

The signature covers the file content. Review the change, sign the final bytes, then validate that exact artifact.

Working through it

Confirm the file is the intended revision and inspect the source-control diff.
If the change is legitimate, complete code review before signing the new bytes.
Sign the final file with the approved code-signing certificate; do not edit it again afterward.
Re-run Get-AuthenticodeSignature from the target environment.

Avoiding it next time

Verify the repair: Validate the final release signature and compare the distributed file hash with the approved artifact.

Primary documentation

Files, storage and hashes documentation