use existing private key for renewed distribution certificate

Hi,

the year is over and we have to renew our distribution certificate. With home office in effect for obvious reasons and thus facing the problem of delivering the new private key to several locations where distribution builds will have to be made, I wonder if it is possible, to use the existing private key for the CSR of the new certificate?

Xcode creates a new private key. There is no option to specify an existing one.

That should be possible using the old route, you say? Right-click on the private key in keychain access, request from certificate authority ... looking good, the well known form appears ... but fails in the end with some unhelpful message about an "object" not being found in the keychain.

The interweb tells me to import the public key (which is part of the certificate, isn't it?), but anyways ... some obscure openssl magic later that public key is in the keychain, CSR started from private key again ... unknown error = -2.147.416.032
:confused:

Does anyone have a working recipe to reuse an existing private key for a renewed distribution certificate?

Thanks in advance!

Replies

I get this same error, and I've been looking everywhere for an answer.

This worked for me:

  1. Go to Keychain Access.

  2. Select My Certificates at the top.

  3. Find my digital identity in the list.

  4. Click the disclosure triangle to display the private key.

  5. Select the private key.

  6. Choose Keychain Access > Certificate Assistant > Request a Certificate From a Certificate Authority With "NNN", where NNN is the name of the private key.

  7. In Certificate Assistant, select Saved to disk and click Continue.

  8. Complete that workflow, which results in a .certSigningRequest file on disk.

I’m testing this on macOS 12.2.1 with a Developer ID Application signing identity.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"