topic Re: iOS Certificate Error in AppStudio Cloud Make in ArcGIS AppStudio Questions

iOS Certificate Error in AppStudio Cloud Make

ChristopherEby1 — Fri, 11 Jan 2019 16:02:07 GMT

We are trying to do an iOS cloud make for our Appstudio app (version 3.1.134) and after queuing the build we get this error:

Cannot read iOS identity from iOS certificate.
Check the iOS certificate has not expired and that you have supplied the valid password.

We are using iOS Development certificates tied to the Apple IDs in our Organizational Apple Developer Program Team and the development provisioning profile is linked to those certificates. I created a sample native app in XCode with the same Bundle Id as my AppStudio app and the same certificate and provisioning profile worked to build and sideload to an iPad. So I think the certificate and provisioning profile are valid. I have verified that I am entering the correct password for my .p12 file so I know it's not that and this same error is occurring for multiple developers. We are able to do successful iOS cloud makes using a distribution certificate and ad hoc distribution provisioning profile. Is there something about development certificates and development provisioning profiles that is incompatible with AppStudio cloud makes? I don't see anything that we are doing wrong in the AppStudio documentation for signing iOS apps (Sign your app—AppStudio for ArcGIS | ArcGIS).

Re: iOS Certificate Error in AppStudio Cloud Make

ShobanaSuresh — Mon, 14 Jan 2019 01:19:06 GMT

Hi Christopher,

>Is there something about development certificates and development provisioning profiles that is incompatible with AppStudio cloud makes?

Development certificates and provisioning profiles are supported in AppStudio Cloud Make. I just submitted a build request with my iOS developer certificate and the build succeeded.

I checked the build logs for your app ( Connects Mobile ) on the AppStudio Cloud Make build server. Build fails when attempting to parse the supplied p12 file.

+ openssl pkcs12 -in 109019/buildrequest-ios.p12 -out temp.pem -nodes -password pass:{secret}

Mac verify error: invalid password?

+ cat temp.pem

+ openssl x509 -noout -enddate

unable to load certificate

Could you please run the below command on a mac machine and let me know if it succeeds with a "MAC verified OK" message?

openssl pkcs12 -in path_to_file.p12 -out temp.pem -nodes -passin pass:enter_password_here

Reference:

/docs/man1.0.2/apps/pkcs12.html

command - Converting PKCS#12 certificate into PEM using OpenSSL - Stack Overflow

Thanks

Shobana

Re: iOS Certificate Error in AppStudio Cloud Make

ChristopherEby1 — Mon, 14 Jan 2019 14:58:33 GMT

Shobana,

Great job sleuthing out which build was mine. Those build logs would be handy to see, is there any way I could see them?

I ran the command on my certificate on a Mac and I did get a MAC verified OK message. It also exported the PEM file successfully on a Linux machine. When I purposefully type my certificate password in wrong I get this message:

Cannot read iOS identify from iOS certificate.
Check that the iOS certificate has not expried and that you have supplied the valid password.
Mac verify error: invalid password?
security: SecKeychainItemImport: MAC verification failed during PKCS12 import (wrong password?)

So I know that the password is accepted at some point because the error message is different when I give it the right password.

Chris

Re: iOS Certificate Error in AppStudio Cloud Make

ShobanaSuresh — Wed, 16 Jan 2019 05:37:13 GMT

Hi Chris,

I've shared the build log in the below link.

Box Notes

There's not much information in the log as the first step which is parsing the p12 file fails.

Are you using any special characters in the p12 file password? I'm wondering if there's a bug in the Cloud Make system when special characters like @ ! are used in password.

Can you try exporting the p12 file with a different password and try again?

Thanks

Shobana

Re: iOS Certificate Error in AppStudio Cloud Make

ChristopherEby2 — Wed, 16 Jan 2019 14:13:52 GMT

The password for the p12 files that fail contain only letters and numbers. The password for our distribution certificate (which works) contains special characters. The two failing development certificate p12s were generated and exported from the same Mac while the distribution certificate p12 was exported from a different Mac. Do you think that there could be different versions of openssl with some kind of compatibility bug between them?

Re: iOS Certificate Error in AppStudio Cloud Make

ShobanaSuresh — Thu, 17 Jan 2019 04:44:16 GMT

Hi Chris,

Good point. Turns out the Cloud Make build server uses a custom version of the openssl binary from /opt/local/bin/openssl folder instead of the default /usr/bin/openssl

Can you run the command "openssl version" on the mac where the openssl command succeeds with MAC verified OK message and let me know the version number? We'll make sure to upgrade the openssl version installed on the mac cloud make build server.

Would you please report this as a bug through the ESRI support channel? This will help with tracking the progress of the bug fix.

Thanks

Shobana

Re: iOS Certificate Error in AppStudio Cloud Make

ChristopherEby1 — Thu, 17 Jan 2019 21:58:21 GMT

I think this is the issue. The version on the Mac I exported the Development certificates from is LibreSSL 2.2.7. The version on the Mac we used to to export our Production certificate (which works) is LibreSSL 2.6.5. I exported a new Production certificate and distribution profile from the older Mac and got the same error. I will report this as a bug.

Re: iOS Certificate Error in AppStudio Cloud Make

ChristopherEby1 — Fri, 18 Jan 2019 16:24:58 GMT

One additional detail. I tried manually updating openssl on our older Mac and re-exporting the certificates. That did not work.

Re: iOS Certificate Error in AppStudio Cloud Make

ShobanaSuresh — Mon, 21 Jan 2019 02:30:03 GMT

Hi Chris,

Thanks for providing the additional details. I'll contact you once we have applied a fix on the Cloud Make servers.

Are the builds with the developer certificate working when you export it from the newer Mac? If yes, would you be able to use this as a workaround until a fix is applied on AppStudio Cloud Make build servers?

Thanks

Shobana

Re: iOS Certificate Error in AppStudio Cloud Make

ShobanaSuresh — Mon, 04 Mar 2019 04:37:28 GMT

Hi Chris,

We've updated the openssl binaries on AppStudio 3.3 beta Cloud Make build servers. Would you please test using AppStudio 3.3 beta and let me know if the build succeeds?

https://community.esri.com/groups/appstudio/blog/2019/02/27/appstudio-for-arcgis-33-beta-now-available

Thanks

Shobana

Re: iOS Certificate Error in AppStudio Cloud Make

ChristopherEby2 — Tue, 05 Mar 2019 16:01:40 GMT

Shobana, thanks for keeping tabs on this. I ran a few builds just to make sure but it looks like it's working the same as it did before the update. I was able to build using the keys exported from a newer Mac and the keys exported from our older Mac give me the same error as before.

Re: iOS Certificate Error in AppStudio Cloud Make

ShobanaSuresh — Wed, 06 Mar 2019 05:32:53 GMT

Hi Chris,

Thanks for testing with AppStudio 3.3 beta.

AppStudio 3.3 beta iOS Cloud Make build server now uses macOS 10.14.2 and OpenSSL version LibreSSL 2.6.5.

My only guess at this point is that the p12 file exported on the old mac supports an old algorithm which the latest openssl binaries don't support. We'll try to see if we can get hold of an old p12 file to reproduce the bug and investigate the issue further.

>The version on the Mac I exported the Development certificates from is LibreSSL 2.2.7. The version on the Mac we >used to to export our Production certificate (which works) is LibreSSL 2.6.5.

Would you be able to export the developer certificates from a newer mac as a workaround?

Thanks

Shobana

Re: iOS Certificate Error in AppStudio Cloud Make

ChristopherEby1 — Thu, 07 Mar 2019 17:21:50 GMT

Shobana,

Yes, we can continue to use that as our workaround.

Thanks,

Chris

Re: iOS Certificate Error in AppStudio Cloud Make

FrédéricSchettini1 — Mon, 12 Aug 2019 20:11:36 GMT

Hi,

I have a similar problem.

I have generated a certificate and provisioning profile for distribution with my Developer Apple Account and a Mac.

When I build my App using AppStudio Cloud Make, I get this error

Based on the error message my certificate has not expired.

If I enter an incorrect password I have a message indicating that my password is wrong. That means that my password previously entered is correct.

Could you please help me to fix this issue because I must deploy my app on the App Store very shortly?

Thank you in advance for your help,

Frédéric;

Re: iOS Certificate Error in AppStudio Cloud Make

ChristopherEby1 — Mon, 12 Aug 2019 20:17:29 GMT

Frédéric, what version of macOS did you generate your certificate with?

Re: iOS Certificate Error in AppStudio Cloud Make

FrédéricSchettini1 — Thu, 15 Aug 2019 00:21:26 GMT

Hi,

I have generated the certificate with a MacOs 10.14.6

What iti is weird; I have a different error message if I try to generate an iOS build with the AppStudio Online (see the error below) rather than if I try to build using AppStudio Desktop (cloud make)

Thanks,

Frédéric

Re: iOS Certificate Error in AppStudio Cloud Make

ShobanaSuresh — Thu, 15 Aug 2019 00:32:05 GMT

Hi Frédéric,

I checked the build logs for your app Citec TwentyFive. The cause for the build failure appears to be different to the original issue reported in this thread.

In the case of your app, the openssl commands succeed and I see a "MAC verified OK" in the logs. Build fails later when importing the p12 file on the build server. There is not much information in the build log providing any clue as to why the build fails.

The best step forward would be to create a support incident with Esri Support to troubleshoot the issue further using your certificate files.

I understand that this is time critical since you are trying to upload the app to App Store soon. You can reach out to appstudiofeedback@esri.com to investigate this issue further.

Thanks

Shobana

Re: iOS Certificate Error in AppStudio Cloud Make

FrédéricSchettini1 — Thu, 15 Aug 2019 22:44:30 GMT

Hi Shobana,

Thank you for your investigation.

Perhaps the p12 file is incorrect.

I am going to contact the AppStudio team via the email you indicated.

Many thanks again,

Frédéric.