3

I've been given ownership of various iOS apps to build, and submit to iTunes Connect, but have run into a very obnoxious issue. Distribution Certificates must be uniquely named, and due to various reasons I have 2 certificates with a single individuals name.

If there are duplicate named certificates, even though they have unique IDs, the build process dies with a Code Sign error that states certificates must be uniquely named. This leads me to a situation where I have to delete the signed certificate(s) I have, download the one I want, rinse, repeat.

And now there's a more difficult problem. I'm reaching a point where these builds are mostly able to be run completely automated via the xcodebuild and xcrun command line binaries, except for the above problem.

Is it possible to store the Public/Private keys somewhere "global", that will be available to any keychain request, and make a new keychain to hold only a single signed certificate, but allow the two keychains to work together in order to pass code signing?

|improve this question
  • Despite how conflicted I am, it is my opinion that this question is on-topic for AD based off the fact that it is only functionally about the Keychain Access utility. The only thing it has to do with code/programming is the fact that it has to pass code signing. But the ultimate underlying procedure exists solely within the built-in Keychain. – Jason Salaz Mar 3 '12 at 8:59
2

It is not possible to link private keys and certificates across multiple Keychains. There needs be a third hidden item called an identity that bonds these two items together. The identity, certificate, and private key need to be in the same Keychain.

Specify the Keychain

Using Keychain Access, create a separate Keychain with a certificate and private key in each. In your situation this will mean creating two separate keychains.

Tell codesign to look for your specific Keychain using the command line option --keychain; the path provided to the Keychain must be absolute.

You can provide this option and path to codesign within Xcode through the build settings user interface.

|improve this answer
  • Would you happen to know if using an identity will also work around the 'duplicate named certificate' limitation? – Jason Salaz Jul 12 '12 at 19:56
  • If you can specify a specific identity, then I believe it will. My understanding is that an identity binds a certificate and private key uniquely. – Graham Miln Jul 13 '12 at 6:40
  • That's awesome. Even though I'm not in a position to execute this activity anymore, I will try to reproduce a test case and verify it in order to accept your answer. Thanks! – Jason Salaz Jul 13 '12 at 6:47
  • You may find the following StackOverflow question useful in setting up Xcode and Keychain: stackoverflow.com/questions/1355637/… – Graham Miln Jul 13 '12 at 7:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .