code sign wants to sign using key - Doesn't all... |Apple Developer Forums

27892 Views 40 Replies

Latest reply on May 23, 2017 9:51 AM by johnfredadams

Level 1 (0 points)

Reedyuk Nov 3, 2015 1:41 PM

Hi guys,

I'm tearing my hair out with this, i have been exporting my certificate for signing and installing on my new machine many times but since i have updated to El Capitan, i have been having issues. At first, i thought i must be exporting wrong, so i created a brand new certificate from the portal and installed but yet i have the same problem.

The certificate and key exists in the keychain, but then when i build to device, it checks the keychain to authorise the use of the certificate and keychain and all that happens is the alert window appears requesting the "codesign wants to sign using key "x" in your keychain" and the buttons Always Allow, Deny and Allow, when i press Always allow or allow, nothing happens, only deny works.

Whats going??? Surely im not doing something wrong am i?

Thanks

Andrew.

Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
ryano Nov 3, 2015 2:58 PM (in response to Reedyuk)

I'm suddenly seeing the exact same issues on all four of my Build Server machines.
This helped me (0)

Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  anwh Jan 13, 2016 2:53 PM (in response to ryano)
  
  Removing the key and adding it again worked for me.
  
  This helped me (0)
  
  Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  jsposato Mar 29, 2016 5:55 PM (in response to ryano)
  
  Any solution? I don't have physical access to my Jenkins OSX build nodes (MacStadium)...
  
  This helped me (0)
  
  Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
ryano Nov 3, 2015 4:48 PM (in response to Reedyuk)
I figured it out!

I noticed this error in the console:

SecurityAgent[xyz]: Ignoring user action since the dialog has received events from an untrusted source

I just installed OS X 10.11.1 and this started happening. Looking at the changelog for 10.11.1, the following "fix" was introduced which prevents apps from digitally "clicking" the Allow or Always Allow buttons:

Impact: A malicious application can programmatically control keychain access prompts
Description: A method existed for applications to create synthetic clicks on keychain prompts. This was addressed by disabling synthetic clicks for keychain access windows.

I was using Screen Sharing to control my Build Servers, and the OS was not allowing the Screen Sharing app to click the allow button. I lined the cursor up over the "Always Allow", then plugged a mouse into my headless Mac and simply clicked the mouse, and it worked!

I hope this helps!
This helped me (6)

Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  Reedyuk Nov 4, 2015 12:07 AM (in response to ryano)
  
  unfortunately not, i am using my iMac locally and not remotely. No screen sharing in use.
  
  This helped me (0)
  
  Actions
  - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
    
    Level 1 (0 points)
    dhogan Nov 4, 2015 10:49 AM (in response to Reedyuk)
    
    I'm facing the same issue. I'm a total mac noob, and this will be the first app I build for my company. That being said I don't think it's limited to xcode, I think it's a security keychain issue in general. If I try and export a cert, I get the same deal when it prompts be for my keychain password. I also followed some other directions(below) that walk you through resetting your default keychain, but that didn't help either. I am using VNC to connect to it, but I went to the box physically and it still doesn't work.
    
    At the end of the day, I thought macs and iphones were supposed to be easy. This whole development paradigm with certificates, identifiers, and provisioning profiles is a bunch of rubbish. There may be a need or purpose for all of it in the background, but there is no reason to have to do all of these things manually. Then add on top of it, there's this keychain issue that won't let me take the last frigin step... I'm convinced the only people that love macs only use the browser.
    
    Edited for clarification: The below was tried and did NOT fix the issue.
    https://discussions.apple.com/thread/7252035
    To reset your keychain in Mac OS X 10.4, Mac OS X 10.5, and Mac OS X 10.6 Snow Leopard or later:
    Open Keychain Access, which is in the Utilities folder within the Applications folder.
    From the Keychain Access menu, choose Preferences.
    Click General, then click Reset My Default Keychain.
    Authenticate with your account login password.
    Quit Keychain Access.
    Restart your computer.
    
    This helped me (2)
    
    Actions
    - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
      
      Level 1 (0 points)
      Reedyuk Nov 4, 2015 10:05 AM (in response to dhogan)
      
      that not a viable solution, i dont want to reset my keychain.
      
      This helped me (0)
      
      Actions
      - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
        
        Level 1 (0 points)
        dhogan Nov 4, 2015 10:48 AM (in response to Reedyuk)
        
        It didn't help anyway. I was really just listing out what HASN'T worked to fix the issue for me. To add to that list:
        
        -Deleted the folder located at users/user/library/preferences/byhost
        
        -Logged in as a different user
        
        -I set the password to something different than the login password.
        
        All end with the same results. It just doesn't work.
        
        This helped me (0)
        
        Actions
  - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
    
    Level 1 (0 points)
    dhogan Nov 13, 2015 11:58 AM (in response to Reedyuk)
    
    I responded to the main post with what I was able to do to get it working. I wasn't able to click the prompt in XCode locally either. After changing access on the cert, it didn't ask me in xcode anymore.
    
    This helped me (0)
    
    Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  milkllc Nov 15, 2015 11:09 AM (in response to ryano)
  
  This reminded me that I was running MagicPrefs, a 3rd party app that enables extra mouse gestures. I quit MagicPrefs and I was able to click the Always Allow button.
  
  This helped me (2)
  
  Actions
  - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
    
    Level 1 (0 points)
    baba.yaga Nov 28, 2015 3:49 PM (in response to milkllc)
    
    Thanks a lot! I also ran MagicPrefs and quiting it also allowed to click on Always allow and to get to a secure note item. Strangely, MagicPrefs did not cause a problem opening a keychain, but it does in the new pop-up window with a password for a protected items.
    
    This helped me (1)
    
    Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
evermagica Nov 8, 2015 6:12 PM (in response to Reedyuk)

I have the same issues and I'm stuck with this problem
This helped me (0)

Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  Appersian Nov 12, 2015 12:36 AM (in response to evermagica)
  
  Did you find a solotion ??? !!!
  
  This helped me (0)
  
  Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  wesib Nov 12, 2015 7:36 AM (in response to evermagica)
  
  Same issue. Build servers are way to far away.
  
  This helped me (0)
  
  Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
hareth Nov 12, 2015 8:52 AM (in response to Reedyuk)

Same Issue
This helped me (0)

Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
any Nov 13, 2015 12:32 AM (in response to Reedyuk)

Same issue.
This helped me (0)

Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
dhogan Nov 13, 2015 11:56 AM (in response to Reedyuk)

I was able to get it working by changing access control for the certificate to allow all applications. I did have to do this locally on the box, but it should be a one time deal. Once this is done, I don't think xcode will ask anymore.

Open Keychain Access
Righ Click on Cert
Click Get Info
Click Access Control
Click Allow all applications to access this item
Save changes
Enter password and apply(note that this step would not work using VNC, it had to be done locally.)

After that XCode didn't ask for access anymore.
This helped me (1)

Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (10 points)
  gusTeam Nov 13, 2015 1:27 PM (in response to dhogan)
  
  When I hit "Save changes". it ask me a password, but nothing will work. I can only refuse/decline. Even the right password won't save. I'm stuck! Apple please help!
  
  This helped me (0)
  
  Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  hareth Nov 16, 2015 3:47 AM (in response to dhogan)
  
  Same Issue than gusTeam
  I tried to reset the password , still can't save changes
  Please Help
  
  This helped me (0)
  
  Actions
  - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
    
    Level 1 (10 points)
    gusTeam Nov 18, 2015 8:26 AM (in response to hareth)
    
    I found a solution!
    
    I am using a software to make the movement of my mouse smoother. The app is called "SmoothMouse" and if it is active, it's impossible to click prompt asked by the keychain. I deactivated it and everything worked fine.
    
    So, if you use VPN or any software that simulate/modify your mouse position, keychain won't let you click on it's popup messages.
    
    This helped me (12)
    
    Actions
    - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
      
      Level 1 (0 points)
      Reedyuk Nov 18, 2015 8:29 AM (in response to gusTeam)
      
      Oh my god, you are right!
      I closed magicprefs - i used this app to make the mouse more sensitive.
      After closing magicprefs, boom it worked!
      
      This helped me (2)
      
      Actions
      - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
        
        Level 1 (10 points)
        J0hn Dec 7, 2015 8:12 PM (in response to Reedyuk)
        
        Also fixed my problem. Wow.
        
        This helped me (0)
        
        Actions
    - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
      
      Level 1 (0 points)
      teddyDeveloperLemonade Nov 19, 2015 9:55 AM (in response to gusTeam)
      
      Same issue with a Wacom Tablet – disconnecting it, repeating the action to present the dialog, and using the built-in trackpad on my MacBook worked.
      
      Oddly, disconnecting the tablet while the dialog was visible didn't seem to be enough. The dialog had to be dismissed and presented again before the trackpad clicks started working.
      
      This helped me (2)
      
      Actions
      - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
        
        Level 1 (0 points)
        gegagome Mar 11, 2016 8:33 AM (in response to teddyDeveloperLemonade)
        
        Thanks for your comment.
        
        I also use a wacom all day and couldn't decipher why it it wouln't work at all.
        
        Thanks again!
        
        This helped me (1)
        
        Actions
      - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
        
        Level 1 (0 points)
        johnfredadams May 23, 2017 9:51 AM (in response to teddyDeveloperLemonade)
        
        Same here - watch out for wacom tablet - frustration ahead - until you disconnect
        
        This helped me (0)
        
        Actions
    - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
      
      Level 1 (0 points)
      nottoohigh Nov 26, 2015 6:16 PM (in response to gusTeam)
      
      Thanks for that! In my case, I had "A Better Touch Tool" running (must be similar to magicprefs) which adds more trackpad gestures. Clicking "Allow" or "Allow Always" would appear to "register" the click, but the dialog box wouldn't go away, it would just stay there. After quitting A better touch tool, it now works fine!
      
      This helped me (0)
      
      Actions
    - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
      
      Level 1 (0 points)
      timgcarlson Jan 7, 2016 10:23 AM (in response to gusTeam)
      
      This was a pretty ridiculous bug to encounter. I was working on setting up OS X Server on a Mac Mini that was located in a server room. I shared the screen of the Mac Mini from my dev machine over a local network. On any popup that had the option to Allow, Deny or Allow Always, I could only click the deny button. Even just hitting enter wouldn't work.
      
      Then when I was trying to "Allow all applications to access this item" on a private key in the system keychain (in the process of exporting my Developer Certificate to the server Mac Mini), it wouldn't let me save changes because of this bug. It would ask for my system password, which I would type in but the save button on the alert was not working.
      
      Finally, after finding this solution, I went into the server room to work on the Mac Mini directly and it now worked. So thanks @gusTeam!
      
      This helped me (0)
      
      Actions
    - Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
      
      Level 1 (0 points)
      Evgueni Poniatovski Feb 28, 2016 2:57 AM (in response to gusTeam)
      
      I'm not a developer. But I had a problem with new cert due to using mouse gestures software...
      Thank you for your advice!
      
      This helped me (0)
      
      Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  Vikram Kagde May 22, 2017 4:35 AM (in response to dhogan)
  
  I used the same solution but still I am getting the pop up message.
  
  This helped me (0)
  
  Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
prestonj Nov 26, 2015 6:53 AM (in response to Reedyuk)

Same problem - can't click Allow through remote desktop.

Is there no option to control this behaviour???
This helped me (0)

Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  alec1996 May 26, 2016 2:47 PM (in response to prestonj)
  
  For MagicPrefs and others, you have to enable access in the Security > Accessibility area of System Preferences. I tried to add ScreensharingAgent to the list of approved control devices, but it won't let me press "ok" when I have an executable selected, only a ".app" file. Ugh. Anyone know how to make it trust the VNC server?
  
  This helped me (0)
  
  Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
baba.yaga Nov 28, 2015 4:21 PM (in response to Reedyuk)

I found a solution posted to this problem for another mouse app: MagicPrefs. I hope this will also help you:
https://getsatisfaction.com/magicprefs/topics/os-x-10-11-1-keychain-acess-app-bug
This helped me (0)

Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
syann Dec 1, 2015 4:23 PM (in response to Reedyuk)

I found xquartz was blocking me in a similar way that magicprefs and other programs did. Xquartz is needed by Inkscape on Mac. After I had removed it I could press always allow and it would work.
This helped me (0)

Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
Spikek Dec 18, 2015 4:43 PM (in response to Reedyuk)

FYI - Snap Z Pro was blocking me from clicking Allow. Kill process if running then delete program.
This helped me (0)

Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
klaus.J.S Feb 3, 2016 12:10 AM (in response to Reedyuk)

For everyone that has a fully virtualized Mac Build Environment where connecting a physical mouse is not possible, here is my solution of that problem using command line.

- Get your certificate inclusive private key from a machine with Yosemite as .p12 file (or from your secure corporate certificate storage).
- open a terminal
- execute following command:
"sudo security import <pathToP12> -k login.keychain -t priv -f pkcs12 -A"
- This will install the Certificate and set the Access Control of the private key to allow all Applications. After that no dialog will appear asking to allow usage.
This helped me (7)

Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  b3no Feb 5, 2016 10:23 AM (in response to klaus.J.S)
  
  Thanks for this! This method of importing via terminal was exactly what I was looking for.
  
  This helped me (0)
  
  Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  dpfannenstiel Feb 16, 2016 8:21 PM (in response to klaus.J.S)
  
  Can you expand on getting the pathToP12. This issue as ended the usefulness of my build server.
  
  This helped me (0)
  
  Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  arimedhelp Feb 19, 2016 3:15 PM (in response to klaus.J.S)
  
  This is definitely the way to go if you don't have access to the server. However you may have to unlock the keychain first before you execute this command.
  
  Is there a reason why you mention Yosemite and not El Capitan?
  
  This helped me (0)
  
  Actions
- Re: code sign wants to sign using key - Doesn't allow or always allow but deny works
  
  Level 1 (0 points)
  nscavezze Aug 17, 2016 10:43 AM (in response to klaus.J.S)
  
  I am trying this but even using this the key is still set to confirm before allowing access. I really need to get a work around figured out going to the data center to hook up a mouse every time the cert expires is not a option. any ideas?
  
  I also tried -T with he path to the build service.
  
  both -A and -T seem to be ignored teh cert is installed but still asks for for approval
  
  This helped me (0)
  
  Actions
Re: code sign wants to sign using key - Doesn't allow or always allow but deny works

Level 1 (0 points)
Tjalsma Feb 18, 2016 12:00 PM (in response to Reedyuk)

This worked for me. I use MagicPrefs to customize the track pad on the Magic Mouse.
This helped me (0)

Actions

Go to original post

Re: code sign wants to sign using key - Doesn't allow or always allow but deny works