Apple Certificates

2024-05-08T15:43:07Z

85.255.235.105: /* Get openssl */

== Creating and using apple developer certificates for signing app in devops ==

=== Get openssl ===

download open ssl 1.x (later versions are not compatible with mac ios see comment below)

So something like OpenSSL-Win64-1-1-1

<syntaxhighlight>
If you are using a build system like cordova and receive an error like this one:

security: SecKeychainItemImport: MAC verification failed during PKCS12 import (wrong password?)

It's because "OpenSSL 3.x changed its default algorithm in pkcs12. Which is not compatible with embedded Security frameworks in macOS/iOS. You could alternatively use OpenSSL 1.x."
</syntaxhighlight>

=== Create a certificate signing request (CSR) ===

<syntaxhighlight lang="bash">
openssl genpkey -algorithm RSA -out d:\\distribution.key

openssl req -new -key d:\\distribution.key -out d:\\distribution.csr -subj "/emailAddress=you@domain.com, CN=Your Company, C=GB"
</syntaxhighlight>

=== Create a distribution certificate using Apple Developer ===

<syntaxhighlight>
Go to https://developer.apple.com/account/resources/certificates/list
</syntaxhighlight>

* Create New Certificate
** Choose "Apple Distribution"
** Upload the distribution.csr file created above
** Download the distribution.cer file

=== Convert into p12 file for devops ===

Using the distribution.cer file you created and downloaded from the apple developer portal and your key file from the first step

You will need to set a password for the certificate (remember this for later.....)

<syntaxhighlight lang="bash">
openssl x509 -in d:\\distribution.cer -inform DER -out d:\\distribution.pem -outform PEM
openssl pkcs12 -export -inkey d:\\distribution.key -in d:\\distribution.pem -out d:\\distribution.p12
</syntaxhighlight>

=== Upload your distribution p12 file into devops ===

Take your shiny new .p12 file and upload it into devops for use by your pipeline

<syntaxhighlight>
Navigate to {project} -> pipelines -> library -> secure files
</syntaxhighlight>

You may also need to update the password variable used by devops, usually this is called p12passwd and is stored in the build pipeline variables

(DO NOT HARDCODE IT INTO THE YAML BUILD FILE)

=== Provisioning File ===

You will also need to create/update the mobile provisioning file so that it links to your new certificate in the apple developer portal

If you forget this stage you will most likely end up with a very unhelpful error from the build such as

<blockquote>Error: /usr/bin/xcodebuild failed with return code: 65</blockquote>

<syntaxhighlight>
Go to https://developer.apple.com/account/resources/profiles/list
</syntaxhighlight>

If it's an existing app, then choose the entry from the list, there should be a single entry per application.

* Choose edit and at the bottom link the new certificate.

* Save the changes

* Download the mobile provision file so for example yourapp.mobileprovision

* Upload the file into the secure files area as per the p12 file earlier

=== Check the build pipeline ===

Check the pipeline build file to ensure that the filenames are correct, note the variable for the p12 password $(p12passwd)

You should now have 2 files in the relevant secure files area of the pipeline

*distribution.p12
*yourapp.mobileprovision

Ensure they are correctly referenced in the build pipeline

<syntaxhighlight>

- task: InstallAppleCertificate@2
displayName: 'iOS certificate installation'
inputs:
certSecureFile: 'distribution.p12'
certPwd: '$(p12passwd)'

- task: InstallAppleProvisioningProfile@1
displayName: 'iOS provisioning profile installation'
inputs:
provisioningProfileLocation: 'secureFiles'
provProfileSecureFile: 'yourapp.mobileprovision'

</syntaxhighlight>

=== References ===

https://help.adobe.com/en_US/air/build/WS5b3ccc516d4fbf351e63e3d118666ade46-7ff0.html#WSfffb011ac560372f284e44b012cd1e700c0-8000

https://gist.github.com/boodle/77436b2d9facb8e938ad

SocialStack - User contributions [en-gb]

Apple Certificates