Importing p12 files with password in Match

[iOSGeekster]

Hi!

Is it correctly understood that match doens't support importing p12 files with a password yet?

To me it seems like the Utils.import in the runner.rb doesn't pass on CERTIFICATE_PASSWORD environment variable to the FastlaneCore::KeychainImport.import_file method.

So I was thinking if the match import should, or could, take a certificate_password argument, that would be passed down?

[maklostermann]

Hello,

I stumbled upon this discussion as I was trying to use match import. After struggling with the import for quite some time, I found out that the key file must be an unencrypted file. At least on MacOS, an encrypted PKCS file cannot be imported with an empty password.

As match encrypts the key file anyway, using an encrypted file with an additional password is not important to me.

However, it took me quite some time to find out how it works (reading the code and analyzing an existing match repository). It would be nice if the documentation (website and command options) of match import would be improved:

• Certificate must be DER encoded (as far as I know).
• Key must be PKCS in PEM (unencrypted).

It would be even nicer if the import command would verify the supplied files before adding them to the repository.

Another limitation is, that it will only work if the certificate and key file have the same name (if I didn't miss something in the code).

[nicobao]

I agree with this take, I just spent lots of time before realizing that was the problem!

[siegeral]

Is there any progress regarding this feature request?

[Lutzifer]

As I struggled for a long time today to do this (knowing I successfully did this before):

To move an existing Enterprise Certificate/Key Pair from the Keychain Access App to match do the following:


1. Open Keychain Access
2. Go into the certificates tab
3. Filter for the certificate you want to export
4. Klick the small “>” next to the certificate to reveal the key
5. Right Klick on the key, choose export
6. Choose the “P12” Format, klick “OK”
7. Do not set a password, just klick “OK”
8. Right Click on the certificate, choose export
9. Choose the “CER” Format, klick “OK”
10. Copy the Certificates.cer and Certificates.p12 files into your project folder
11. Run

bundle exec fastlane match import --readonly true --type enterprise --skip_certificate_matching true

When asked for the .cer file, write Certificates.cer
When asked for the .p12 file, write Certificates.p12

When asked for the mobileprovisioning files, just hit enter.



To import a profile, run e.g.

openssl aes-256-cbc -k <MATCH_PASSWORD> -in unencrypted.mobileprovision -out encrypted.mobileprovision -a

and upload the result to the "profiles/enterprise" folder of your match repo.

[Lutzifer]

updated the docs in #22176