Cannot convert apple developer_identity.cer to .p12 format. Certificate does not match private key

i has the following problem:

I have these files

developer_identity.cer

Team_Provisioning_Profile_.mobileprovision

To pack adobe flex mobile for iOS, I need to convert the .cer certificate to .p12. Following this guide on help.adobe.com , I always get this problem when running the latest openssl command:

"certificate does not match private key
error in pkcs12 "

From what I understand, I need to somehow get the secret key that was used to create the certificate (do I understand this well?). How to get mykey.key private key if I only have the .cer and .mobileprovision files mentioned above?

+6
source share
4 answers

Not sure if you can get your secret key if you lost it.

The key is created when you request a certificate so that you can request a new certificate and it must provide you with the private key.

+5
source

..cer does not contain your private key, and you cannot generate its .p12 file. You must export both of them simultaneously from the keychain. If you only have a .cer file, this is useless, and you will need to create a new private key and a couple of certificates.

+6
source

OpenSSL says that the certificate does not match the private key when the certificate is DER-encoded. Just change it to PEM encoding before creating PKCS # 12.

  • Create a key pair: openssl genrsa -out aps_development.key 2048

  • Create a CSR: openssl req -new -sha256 -key aps_development.key -out aps_development.csr

  • Download CSR to the developer portal to get aps_development.cer certificate

  • Convert certificate: openssl x509 -inform DER -outform PEM -in aps_development.cer -out aps_development.pem

  • Create PKCS # 12: openssl pkcs12 -inkey aps_development.key -in aps_development.pem -export -out aps_development.p12

+3
source

You open the Keychain Access program, available in the "Applications / Utilities" section. In the category list on the right, select "My Certificates."

This gives you a list of all the certificates installed in your keychain. If you are not familiar with what a keychain is. It is basically a secure database containing login passwords, certificates, private keys, etc.

When downloading a certificate, double-click it to import it into the keychain.

You can then find your certificate in the My Certificates list. If you expand the certificate that interests you to search for the private key, it should be shown right below the certificate.

I bet you just followed the guide and took steps, and it’s not exactly what you did. We are doing everything right :-)

How it works, you first create the public and private keys together in the keychain access program. Typically, in encryption, how you use them, you provide your public key to someone, and then you can encrypt the message and send it. Only the person with the private key that was created with this public key can decrypt the message.

But anyone who receives your public key cannot know for sure if this is really from you. There are certificates here. A third party, such as Apple, which most people trust, will sign your public key, which creates the certificate. So, what you probably did before, sent your public key to Apple, which signed it and thereby created a certificate that you could download.

Let me give a short version:

  • Keychain access is used to create a public / private key
  • You create a certificate signing request with your public key. This is basically a public key file in which Apple asks to create a certificate from this public key.
  • Apple adds a ton of information about you and the purpose of the public key, and also adds the public key to the file, which becomes a certificate. Then the apple signs it.
  • You are uploading a certificate.
  • Double-click and import the certificate into the keychain.
0
source

Source: https://habr.com/ru/post/906482/


All Articles