Apple Certificates
Creating and using apple developer certificates for signing app in devops
Get openssl
download open ssl 1.x (later versions are not compatible with mac ios see comment below)
If you are using a build system like cordova and receive an error like this one:
security: SecKeychainItemImport: MAC verification failed during PKCS12 import (wrong password?)
It's because "OpenSSL 3.x changed its default algorithm in pkcs12. Which is not compatible with embedded Security frameworks in macOS/iOS. You could alternatively use OpenSSL 1.x."Create a certificate signing request (CSR)
openssl genpkey -algorithm RSA -out d:\\4Roads_Distribution.key
openssl req -new -key d:\\4Roads_Distribution.key -out d:\\4Roads_Distribution.csr -subj "/emailAddress=Robert.Nash@4-roads.com, CN=4 Roads LTD, C=GB"
Create a distribution certificate using Apple Developer
Go to https://developer.apple.com/account/resources/certificates/list- Create New Certificate
- Choose "Apple Distribution"
- Upload the csr file created above
- Download the distribution.cer file
Convert into p12 file for devops
You will need to set a password for the certificate (remember this for later.....)
openssl x509 -in d:\\distribution.cer -inform DER -out d:\\distribution.pem -outform PEM
openssl pkcs12 -export -inkey d:\\4Roads_Distribution.key -in d:\\distribution.pem -out d:\\4Roads_Distribution.p12
Convert into p12 file for devops
Take your shiny new .p12 file and upload it into devops for use by your pipeline
{project} -> pipelines -> library -> secure files
You may also need to update the password variable used by devops to import the certificate, usually this is called p12passwd and is stored in the build pipeline variables
(DO NOT HARDCODE IT INTO THE yaml build file)
Provisioning File
You will also need to create/update the mobile provisioning file so that it links to your new certificate in the apple developer portal
If you forget this stage you will most likely end up with a very unhelpful error from the build such as
Error: /usr/bin/xcodebuild failed with return code: 65
https://developer.apple.com/account/resources/profiles/list
If its an existing app, then choose the entry from the list, there should be a single entry per application.
Choose edit and at the bottom link the new certificate.
Save the changes
Download the mobile provision file so for example {yourapp}.mobileprovision
Upload the file into the secure files area as per the p12 file earlier
Check the build pipeline
Check the pipeline build file to ensure that the filenames are correct, note the variable for the p12 file pwd
- task: InstallAppleCertificate@2
displayName: 'iOS certificate installation'
inputs:
certSecureFile: '4Roads_Distribution.p12'
certPwd: '$(p12passwd)'
- task: InstallAppleProvisioningProfile@1
displayName: 'iOS provisioning profile installation'
inputs:
provisioningProfileLocation: 'secureFiles'
provProfileSecureFile: '{yourapp}.mobileprovision'
