Hi,
My certificates expired and I created new ones.
But now Xcode shows me in Apple Accounts status of Mac App Distribution that the Missing Private...
Howto fix the missing private key?
I need to sign a .pkg for upload with Transporter.
Further I generated a CSR for App License Delivery ALD certificates.
https://developer.apple.com/help/account/certificates/create-a-certificate-signing-request/
And with App Store Connected I created new certificates.
In Xcode I had to remove the Apple Account and add it again, after altering currency. This procedure was described somewhere because Xcode was not able to connect my account. This is fixed now.
As reading about Certificate types, I think this certificate is missing:
No. As I mentioned above, that platform specific distribution certificate type is no longer relevant. It’s been subsumed by Apple Distribution, which works for all platforms.
What is with these 2 files?
You’re asking me?!?
Seriously though, Apple’s standard processes don’t use openssl. If you go down that path, you won’t find any help from Apple sources.
And I think that speaks to the main issue you’re having here:
- Apple’s code-signing infrastructure relies on digital identities in the keychain.
- A digital identity is the combination of a certificate and the private key that matches the public key in that certificate. Both of these have to be in the keychain.
- The
opensslsequence you posted above doesn’t add the private key to the keychain. It just leaves it hanging around in PEM files (.key).
So, for code signing to work you need to import these private keys into the keychain [1]. Or you need to use a mechanism, like Certificate Assistant or Xcode, that generates these private keys in the keychain.
For more background on this, see Certificate Signing Requests Explained and the expanded discussion in TN3161 Inside Code Signing: Certificates.
Taking a step back, I think you should go back to basics and get your code-signing identity sorted out. Consider this:
% cp "/usr/bin/true" "MyTrue"
% codesign -s "Apple Distribution" -f "MyTrue"
MyTrue: replacing existing signature
This makes a copy of the true tool and re-signs it for App Store distribution [2]. You should try this. If it works, your code-signing identity is copacetic. If it doesn’t work, you need to sort that out first.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] That in and of itself is tricky. Keychain Access won’t import a private key PEM (it can use PEM, but only for certificates). The only way around this that I’m aware of is to use openssl to combine the private key and certificate into a .pk12 and then import that.
[2] This is a very unrealistic example. The whole point is to illustrate this type of code signing in action.