Firebase & PowerShell Execution Policy
Tags: firebase, powershell, security, microsoft
Published: 2023-09-25 22:47:00

when you install the **Firebase** via npm:
```shell
npm i -g firebase firebase-tools
``` 
and try to run:
```shell
firebase login
```
it throws an error into your terminal that says that the execution policy of Powershell is preventing you from running this script or any unsigned script certificate, which is quite fair making your system secure from malicious scripts. Still, why is Firebase not a signed and white-listed script 🤷‍♂️?

will I get you covered, instead of dropping the security layer of your ExecutionPolicy in Powershell by this command ⛔?
```shell
Set-ExecutionPolicy -ExecutionPolicy Unrestricted
```
which will make your machine vulnerable to malicious scripts,
we will create a **signed certificate** for the `firebase.psl` script and we will install it.

## Create A Signed Certificate

first, make sure your terminal is in elevated privileges (Run as Administrator)

Then let's make our certificate for our `firebase script` using this command:
```shell
New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -Subject "CN=Firebase" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3") -FriendlyName "Firebase Script"
```

![screenshot of runnig the Script in the terminal](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kugvqf6ofi2lekbxg5hm.png)



this will generate our certificate in the directory `C:\Users\{username}\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates` script using [New-SelfSignedCertificate](https://learn.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate?view=windowsserver2019-ps), you will see the `Thumbprint` which is the also the name of the certificate file in the listed directory, you can always verified using this command:
```shell
Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
```
will now the certificate is been initialized now we need to install it.

## Install Certificate

follow these steps to install the certificate:

click: `win+R` and write `control`, or open the control panel

![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0xt4a65e7l81x2ub7d7b.png)

the search for `certificates` in the control panel:


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h5pvwmmhjygqxnb0aec0.png)

the Click **Manage User Certificates Link** and you will see a window like this:


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1dwxdybi7j90j87q1xc1.png)

then click on **Trusted Root Certification Authorities** and then click on **certificates**:


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5savbgqf90r99nk6m0q8.png)

what you have to do is click on `actions` => `all tasks` => `import`, and you will see this window:


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4aen10zdjg3jyj524lfq.png)


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dc9oqjmsbtud3lpnn7es.png)

then click `next` and the `brows`


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uwqzty4cbfsemcl627df.png)


and head to this path: `C:\Users\{username}\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates`, replace the `{username}` with your account username folder. then click `All files`


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pxgs07ae0r3rwe0o2299.png)

what is left is to choose the created certificate earlier,
verified the name of the file using this command:

```shell
Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
```
you will see the `Thumbprint` which is also the name of the certificate file in the listed directory, click it and click next then you will see this screen just click next:


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qlzdybh9fw7526ejjupf.png)

then click finish and the created certificate will be installed and ready to use:


![Window Screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wolahqmhgsi4vt8csq91.png)

then what's left is to sign the `firebase.psl` certificate with the installed certificate using this command:

first, we store the certificate in a variable called `$cert`

```shell
$cert = Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
```
then we proceed in the process:

```shell
Set-AuthenticodeSignature -Certificate:$cert -FilePath:"C:\Users\{user}\AppData\Roaming\npm\firebase.ps1"
```
replace the `{user}` with your account username and the `firebase.psl` is now white-listed and ready to use without any errors

```shell
firebase login
```