Create key, certificate signing request, p12 file and provisioning file on Ubuntu for Mac keychain

Question

I use Ubuntu OS most of the time but I also have used OS X for quite a time and now I only use it to maintain my iOS apps. I am trying to create private key, certificate signing request for certificate and p12 key and provisioning file on Ubuntu and I think I am missing something.

openssl genrsa -out mykey.key 2048

This generates private key for me to generate Certificate Signing Request.

openssl req -new -key mykey.key -out CertificateSigningRequest.certSigningRequest -subj /[email protected], CN=Umair Ashraf, C=PK

This is generates Certificate Signing Request for me to send it to Apple to sign it.

I downloaded ios_development.cer file from apple and I have 3 files in hand. Now I want to create p12 out of them so I can import them in keychain of my OS X machine.

openssl pkcs12 -export -clcerts -inkey ./mykey.key -in ./ios_development.cer -out ./dev_testing.p12 -name "Umair Ashraf"

This creates me p12 file but with an error which reads unable to load certificates. When I tested this p12 file, it did not seem to work as well. What am I missing.

I also want to ask if this p12 file will be password protected? If not how can I password protect it?

Answer 1

I also ran into this problem when trying to import a pkcs12 certificate. The certificate worked fine everywhere else.

Tracked the problem down to the "Friendly name". Apparently that isn't supported by MacOS. Trying to import manually just gives a vague "unknown format" error:

security -v import test.pfx -f pkcs12 -P password
security: SecKeychainItemImport: Unknown format in import

The solution is to omit the -name "Friendly Name" option when creating the pkcs12 certificate.