UPDATE Oct 2019: 2FA breaks things :(
How many times have you been working on a cross platform app and been ready to submit to the app stores, but then the Apple store needs a .csr that you should “use a Mac” to generate?
When I google this, I got lots of complicated methods using IIS to request certificates through a quite frankly terrible UI/UX, and most of the guides glossed over how to actually get that .p12 at the end you needed.
UPDATE: 2FA breaks the automated links with the AppStore, making things quite painful indeed.
While this is all still correct, you may still need a Mac to help if you have 2FA on the Apple Id.
Details at the end.
ANOTHER UPDATE: This is slightly unrelated to certificates, but the codeSignIdentity
MUST be iPhone Developer
regardless of production/development.
I’m sure some of those guides work, but I was sure it had to be easier than that. I found this post which does it all in four commands…A colleague pointed out that it’s from 2012 and is still relevant, but it works.
I’ll pull it out here in case the links break but this is all Ian Devlin’s work. I’m just replicating it.
Install OpenSSL (Directly didn’t work for me, but it came installed with Cmder)
Generate a key
openssl genrsa -des3 -out ios.key 2048 // must be 2048
Use key to generate Certificate Signing Request (CSR)
openssl req -new -key ios.key -out <csrName>.csr -subj '/emailAddress=MY-EMAIL-ADDRESS, CN=COMPANY-NAME, C=COUNTRY-CODE'
Upload the .CSR to the portal which then gives you a .CER in return
Convert .CER to a .P12 (Required to sign apps, or at least Cordova apps)
openssl x509 -in ios_<development/distribution>.cer -inform DER -out <pemName>.pem -outform PEM
openssl pkcs12 -export -inkey ios.key -in <pemName>.pem -out <p12Name>.p12
That’s it! No more hunting for someone around the office with a Mac.
Update Aug 2020: If you do want to run things up on a Mac at some point, you’ll need those .CER
and .P12
files to install into the keychain. The CER
is the certificate, and the P12
is the private key.
Should just be able to double click them (CER
first) and follow any prompts to get them into the keychain.
UPDATE Oct 2019
I had an issue where the only Apple ID in use by the client (and our CI pipeline) was upgraded with 2FA.
This caused the old ‘deploy to AppStores’ stuff to break, and apparently there are only two fixes at this time (without xcode):
According to the official documentation on the Microsoft Azure Devops ‘Deploy to Appstore’ task, 2FA shouldn’t be enabled on the CI Apple ID, and there should be one specifically for CI. This wasn’t an option for me at the time.
fastlane spaceauth -u <appleId user name>
Tags: ios