Apple Developer /iOS Distribution Certificate Management

Question

We are struggling with the Distribution Certificate handling from Apple. We have several developers setup in the Apple Developer Portal, for the sake of the example: Alice: Team Admin Bob: Admin Charles: Admin Dan: Developer

Alice, Bob, and Charles should be able to build Apps for Distribution (Adhoc for internal testing, Testflight for external testing, and Appstore for distribution). Dan is only producing code and debugging on his local machine. All users use individual accounts for the development.

From what we understood from the Apple documentation, Alice, Bob, Charles need a valid distribution certificate. If xCode generates it for them, they will start playing “ping pong”, and keep revoking each other’s certificate – at least this is what appears to be happening at the moment. We are not sure why this would happen. One would think, that if you create a different new user this account can also maintain his own (distribution) certificates.

Anyway, so they will need to share a distribution certificate, by sharing the private key (p12 file) of it, as you can find in the answer here.

In our account, it appears as if we can have up to two valid distribution certificates. We don’t really know how this ultimately worked – we didn’t do it manually over the developer portal, but used xCode for it. Alice generated her certificate, Bob revoked and regenerated, Alice did the same thing – but suddenly they both had a valid distribution certificate, instead of invalidating Bobs certificate.

In the documentation it was mentioned that you can have up to 2 valid distribution certificates. We have also manually tried to generate the distribution certificates and could confirm that it is limited to two.

However, we then got recently invited to a customer’s developer program to sign apps on his behalf. I assume the customer was not aware that we require the private key from his distribution certificate. We therefore tried to manually generate a distribution certificate, and saw that it was not possible. To our surprise though, the customer managed to generate 3 valid distribution certificates. Any idea how this worked?

Our questions in a nutshell:

1. What is best practice when you manage a team of developers?

Do you normally share the private key of the first developer who generated the certificate with all other team members, which should be able to sign the app?

2. What is the best practice when you work with clients? Do you ask them to generate another private key, or is there some hidden functionality to generate as many distribution certificates as you want, given that every developer uses his own account?

3. What happens when we revoke a certificate. It doesn’t affect the apps in the app store, but only seems to limit other developers to build their app. However, what happens with APNS / Push Server certificates? When we revoke a distribution certificate through xCode, will this also suddenly stop working for the sender?

Thank you for your help.

Answer 1

After a long time of investigation and trying things out, here is what we think is the best fit for us. Not sure if it is best practice but it seems to work for us just fine.

1. What is best practice when you manage a team of developers?

One person generates a distribution certificate using his mac. He then exports the certificate (public AND private key) in a p12 file, as suggested by washloops and shares it with the team.

2. What is the best practice when you work with clients?

We have two sorts of clients:

Clients working with multiple suppliers (so we are just taking care of 1 app, out of their portfolio) - We ask them to share their distribution certificate (public + private key). If they don't have it, they need to get it from another vendor.

Clients working only with us - We generate the certificate and share it with the client later on. This allows them to share it with other vendors if they need to.

3. What happens when we revoke a certificate.

From our tests: "nothing". If you revoke a distribution certificate, it will prevent developers using this certificate from submitting / building apps. However, existing APNS / Push certificates are not affected.

For us it seems as APNS / Push certificates are totally independent, and if you wish to revoke them, you need to revoke both.