自签名证书到期对SDK的影响

Code Signing Certificates, Identifiers & Profiles
mc_mc OP
Created 6d
Replies 2
Boosts 0
Views 95
Participants 2

我们开发了一款SDK，并用自签名证书对SDK进行了签名，我们的证书会在2025年1月30日到期，到期后对已发布至appstore的app会有影响吗？

用户在2025年1月31日打开app时，会因为自签名证书到期而闪退吗？有不少app集成了我们的SDK，这个问题对我们来说非常紧急和重要，麻烦尽快回复，谢谢！

以下是我们的签名步骤： 自签名步骤：self-signed certificate xcframework 1、钥匙串创建：证书助理-创建证书-自签名根证书+代码签名 2、自行签名根证书修改信任设置 3、对已经打包好的xcframework进行签名 （官方命令示例）codesign --timestamp -v --sign "证书名字" ~/Desktop/MySDK.xcframework

Answered by DTS Engineer in 821411022
If a user opens the app on January 31, 2025, will the app crash due to the expired self-signed certificate?

No. When a developer submits their app to the App Store, they have to sign all the code within their app with their distribution signing identity. That means that the App Store never sees the certificate in your XCFramework.

Beyond that, the App Store re-signs the app before distributing it to users. I talk about this in more detail in the App Store re-signing section of TN3161 Inside Code Signing: Certificates.

Having said that, signing an XCFramework with a digital identity whose certificate is self-signed is a weird choice, because it means the Xcode can’t check that version N+1 of your SDK is the ‘same’ as version N. You should use a stable signing identity for this. Most folks use their Apple Distribution identity.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Replies  2
Boosts  0
Views  95
Participants  2
mc_mc OP
5d

The impact of self-signed certificate expiration on the SDK. We have developed an SDK and signed it with a self-signed certificate. Our certificate will expire on January 30, 2025. After it expires, will there be any impact on apps that are already published on the App Store?

If a user opens the app on January 31, 2025, will the app crash due to the expired self-signed certificate? Many apps have integrated our SDK, and this issue is very urgent and important for us. We kindly ask for your prompt reply. Thank you!

Here are the steps we followed for signing: Self-signing steps: self-signed certificate xcframework

Keychain creation: Certificate Assistant - Create Certificate - Self-signed Root Certificate + Code Signing Modify trust settings for the self-signed root certificate Sign the already packaged xcframework (Official command example) codesign --timestamp -v --sign "Certificate Name" ~/Desktop/MySDK.xcframework

0
DTS Engineer OP
Apple
5d
Accepted Answer
Recommended
If a user opens the app on January 31, 2025, will the app crash due to the expired self-signed certificate?

No. When a developer submits their app to the App Store, they have to sign all the code within their app with their distribution signing identity. That means that the App Store never sees the certificate in your XCFramework.

Beyond that, the App Store re-signs the app before distributing it to users. I talk about this in more detail in the App Store re-signing section of TN3161 Inside Code Signing: Certificates.

Having said that, signing an XCFramework with a digital identity whose certificate is self-signed is a weird choice, because it means the Xcode can’t check that version N+1 of your SDK is the ‘same’ as version N. You should use a stable signing identity for this. Most folks use their Apple Distribution identity.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0
自签名证书到期对SDK的影响
First post date Last post date
 
 
Q