App Store distribution certificate expiring

[mortenholmgaard]

"Your certificate 'xxx.cer' is not valid, please check end date and renew it if necessary"

The problem of expiring certificates to me is one of the few fundamental signing features that fastlane has not yet solved, and though it is not easy, it is one of those problems we all face again and again - I really hope we can put this issue to bed soon!

There was a solution proposed some time ago and I just hope it will be implemented:
#10724 (comment)

Currently the only real fixe besides nuke is to delete the relavant certificate and provisioning profiles both in developer portal and in the match repo.

[crazymanish]

Hi
Till we have a proper solution...please feel free to use the below lane to renew your expiring certificate

lane :renew_expiring_certificate do
    expiring_certificate_type = "appstore"  # or "development"

    match_nuke(
      api_key: app_store_connect_api_key,
      type: expiring_certificate_type,
      readonly: false,
      skip_confirmation: true
   )

    match(
      api_key: app_store_connect_api_key,
      type: expiring_certificate_type,
      readonly: false,
      generate_apple_certs: true,
      force: true
   )
end

[lucgrabowski]

Hi, please remember that nuking will remove all the certificates of selected type and all the profiles that are created with it. There is no option to remove one specific profile / certificate at the moment. I'm saying it aloud just in case...

[escakot]

@lucgrabowski, does nuking remove all certificates & profiles created by the user that authenticated? Or does it delete everything including other people's certificates & profiles in your iOS team? 😱

[lucgrabowski]

It nukes all the certificates of the type that you select (distribution, development, enterprise) and profiles created with them.
You can read more in http://docs.fastlane.tools/actions/sync_code_signing/#nuke
If you update to the newest fastlane version and you're not using it on CI and don't use force option, you will be able to select one certificate instead of nuking all of them. More info: #19584

[escakot]

Phew. Lucky I didn't pull the trigger on that. We have multiple app identifiers and I only wanted to automate codesigning for 1 app for our team. 😅

This new functionality looks great! Going to update our fastlane now. Thank you and the fastlane team for making such a great tool.

[yakimant]

Hi!

This is indeed a very old issue since match tool appered.

The problem is, that Apple Dev Portal allows to have a second certificate to have a smooth transition, but not match.

For match previously there were two solutions:

1. Wait for certificate to be expired. Cleanup the match git repository. Run match to create a certificate and profisioning profile.
2. Run nuke to remove certificates and provisioning profiles on both Developer Portal and match git repository.

Recently I discovered another one, which work great:

1. (optional) Figure out, how many days left before certificate expired. Using Manually manage the fastlane match Repo and openssl x509 -noout -enddate -inform der. You can use it in if logic to decide to run the next step or not.
2. Run match_nuke with safe_remove_certs (kudos to for @crazymanish and @lucgrabowski), Note, it only supports type, but not the app_identifier, this might be critical for you. But we decided to renew all certificates at the same day once a year. This will remove certificates and provisioning profiles in the repo and provisioning profile on Dev Portal. But it will keep the signing certificate on Dev Portal.
3. Now just run match, it will generate everything needed without any errors.
4. The old signing certificate will keep working until expired. It means you will have some time to update developers machines, CI hosts and rebuild/deploy the Enterprise apps.

The last GitHub issue to automate these steps is #19743

[pke]

@yakimant so one could think that could be done via a cron job once a month to figure out if the cert is about to expire in a month and then perform steps 2-3? How would that work with 2FA enabled on the apple ID?

[yakimant]

@pke, we decided to run this manually once 11 months, not a big deal, but better control of this fragile, but important matter.

Regarding 2fa, I don't remember (don't have access to code anymore), it should be one of those cases:
https://docs.fastlane.tools/getting-started/ios/authentication/
With app-specific password or appstoreconnect api key - it's easy. With 2fa cookie - it's only alive for 30 days.