bmm-app/doc-renew-apple-certificates.yaml at develop · bcc-code/bmm-app · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
- This needs to be done once a year
- Create new distribution certificate
  - Note: Wherever it says 2025 insert the current year
  - go to https://developer.apple.com/account/resources/certificates/list
  - create a new certificate (iOS Distribution)
  - follow guide to create a certificate signing request https://developer.apple.com/help/account/create-certificates/create-a-certificate-signing-request
  - use something like this for the Common Name "BMM Distribution 2025"
  - upload the *.certSigningRequest
  - create a new password "BMM Apple Certificate 2025" in 1Password under bcc-media-dp-bmm
  - generate a new super secure password (like 40 letters, ...) (you should only every copy & paste it)
  - download the newly created certificate and double-click it to install in your Keychain
  - identify the new certificate in Keychain Access (something like: "Apple Distribution: BCC Media")
  - right click the certificate and export it as "BMM_Distribution_Certificate_2025.p12" (no spaces)
  - set the newly created password from 1Password
  - also export the private key and call it like "BMM Distribution Certificate 2025 private key.p12" and protect it with the same password. (make sure to call it private key, so that it's not accidentally uploaded where it doesn't belong)
  - it's recommended to delete the old certificate to prevent confusion and other problems.
- create new provisioning profiles
  - Create a new provisioning profile (Distribution - App Store Connect)
  - select "VS org brunstad bmm" as App id
  - select the newly created certificate
  - enter "org.brunstad.bmm AppStore" as name
  - (keep this name exactly, without the year. It is the profile name, not the filename, and it is referenced as <CodesignProvision> in the .csproj. The filename you upload to Secure Files is free to carry the year, see below.)
  - Create new provisioning profile for Siri Intents (Distribution - App Store Connect)
  - select "Siri Intents for BMM" as App id
  - select the newly created certificate
  - enter "BMM App Siri Intents Provisioning Profile" as name
  - upload the following files to the 1Password entry
    - "ios_distribution.cer"
    - the p12 file and the p12 private key
    - the two .mobileprovision files
- Update the certificate name in the repository
  - the certificate's common name is hardcoded as <CodesignKey> in BMM.UI.iOS/BMM.UI.iOS.csproj and BMM.UI.iOS.SiriIntents/BMM.UI.iOS.SiriIntents.csproj (Release|iPhone and UITests|iPhone)
  - check the exact name in Keychain Access, or run "security find-identity -v -p codesigning"
  - it must match character for character. Certificates created as "Apple Distribution" are named "Apple Distribution: ...", while the older "iOS Distribution" type is named "iPhone Distribution: ...". Picking the other type in the portal changes this string and the build fails with "code signing key ... not found in keychain".
- Update the build pipeline
  - go to [Library -> Secure files](https://dev.azure.com/bcc-its/BMM/_library?itemType=SecureFiles) and upload
  - "BMM_Distribution_Certificate_2025.p12" (NOT the private key)
  - upload the two .mobileprovision files. Give them names that include the year, e.g. "BMM_App_Provisioning_Profile_2025.mobileprovision" & "BMM_App_Siri_Intents_Provisioning_Profile_2025.mobileprovision", so the old entries can stay untouched and you can roll back by pointing the variables at them again.
  - go to [Library -> Variable groups -> Apple Certificate](https://dev.azure.com/bcc-its/BMM/_library?itemType=VariableGroups&view=VariableGroupView&variableGroupId=140&path=AppleCertificate) and update the filenames and password
    - P12File, ProvisioningProfileApp and ProvisioningProfileSiri hold the Secure Files names. The pipeline reads all three from here, so renewing files never requires a repository change.
    - the profiles must be regenerated whenever the certificate is replaced. A profile embeds the certificate it was created against, and the build fails with "No iOS signing identities match the specified provisioning profile" if the two do not agree. Replacing the p12 alone is not enough.
    - you might need to delete the password and recreate it (not sure if it's necessary. Please try and update these instructions)
  - the next time the build runs, it will wait for you to give it permission to access the newly uploaded files. Therefore it might make sense to start a new build and do it right away.