How to import existing certificates (and provisioning profiles? and identifier?) for fastlane?

[gojanpaolo]

Hi! We currently use fastlane to manage/create certificates/provisioning profiles/identifiers/etc and stores it in a GCP bucket.
But we now have a customer that would like us to use their existing certificates. We were able to import it manually by doing the following:

security import FOO.cer
security import FOO.p12 -A -P 'BAR'

But that seems like it bypasses the GCP bucket. And we also have to manually do that everytime we run fastlane for our customer because our CircleCI runners are ephemeral.

How can we import those certificate in fastlane properly?

We tried fastlane match import --readonly true --type appstore which stores the certs on our bucket. But our fastlane fails with error: No signing certificate "iOS Distribution" found.
We're not sure if it's because the cert needs a password (like security import FOO.p12 -A -P 'BAR') which is not asked when we run fastlane match import ...

Thank you!