Apple Certificates

Creating and using apple developer certificates for signing app in devops

Get openssl

download open ssl 1.x (later versions are not compatible with mac ios see comment below)

If you are using a build system like cordova and receive an error like this one:

security: SecKeychainItemImport: MAC verification failed during PKCS12 import (wrong password?)

It's because "OpenSSL 3.x changed its default algorithm in pkcs12. Which is not compatible with embedded Security frameworks in macOS/iOS. You could alternatively use OpenSSL 1.x."

Create a certificate signing request (CSR)

openssl genpkey -algorithm RSA -out d:\\distribution.key

openssl req -new -key d:\\distribution.key -out d:\\distribution.csr -subj "/emailAddress=you@domain.com, CN=Your Company, C=GB"

Create a distribution certificate using Apple Developer

Go to https://developer.apple.com/account/resources/certificates/list

• Create New Certificate
  • Choose "Apple Distribution"
  • Upload the distribution.csr file created above
  • Download the distribution.cer file

Convert into p12 file for devops

Using the distribution.cer file you created and downloaded from the apple developer portal and your key file from the first step

You will need to set a password for the certificate (remember this for later.....)

openssl x509 -in d:\\distribution.cer -inform DER -out d:\\distribution.pem -outform PEM
openssl pkcs12 -export -inkey d:\\distribution.key -in d:\\distribution.pem -out d:\\distribution.p12

Upload your distribution p12 file into devops

Take your shiny new .p12 file and upload it into devops for use by your pipeline

Navigate to {project} -> pipelines -> library -> secure files

You may also need to update the password variable used by devops, usually this is called p12passwd and is stored in the build pipeline variables

(DO NOT HARDCODE IT INTO THE YAML BUILD FILE)

Provisioning File

You will also need to create/update the mobile provisioning file so that it links to your new certificate in the apple developer portal

If you forget this stage you will most likely end up with a very unhelpful error from the build such as

Error: /usr/bin/xcodebuild failed with return code: 65

Go to https://developer.apple.com/account/resources/profiles/list

If it's an existing app, then choose the entry from the list, there should be a single entry per application.

• Choose edit and at the bottom link the new certificate.

• Save the changes

• Download the mobile provision file so for example yourapp.mobileprovision

• Upload the file into the secure files area as per the p12 file earlier

Check the build pipeline

Check the pipeline build file to ensure that the filenames are correct, note the variable for the p12 password $(p12passwd)

You should now have 2 files in the relevant secure files area of the pipeline

• distribution.p12
• yourapp.mobileprovision

Ensure they are correctly referenced in the build pipeline

      - task: InstallAppleCertificate@2
        displayName: 'iOS certificate installation' 
        inputs:
          certSecureFile: 'distribution.p12'
          certPwd: '$(p12passwd)'

      - task: InstallAppleProvisioningProfile@1
        displayName: 'iOS provisioning profile installation' 
        inputs:
          provisioningProfileLocation: 'secureFiles'
          provProfileSecureFile: 'yourapp.mobileprovision'

References

https://help.adobe.com/en_US/air/build/WS5b3ccc516d4fbf351e63e3d118666ade46-7ff0.html#WSfffb011ac560372f284e44b012cd1e700c0-8000

https://gist.github.com/boodle/77436b2d9facb8e938ad