Is it possible to get data from the certificate iOS application was signed with?

Question

I need to programmatically get data (public key) from a certificate that was used to sign the iOS application. Does anyone know whether this is even possible? Is there some API? Looks like there are severals solutions for MacOS, but none of them fits iOS.

Answer 1

Try following steps:

1. Extract the content of your iOS App (extension: .ipa). You can simply use Archive Utility for this.
2. Switch to the extracted content, where you see an App file (extension: .app)
3. Right click on the app and choose Show Package Contents
4. You'll see the provisioning profile you used under the name: embedded.mobileprovision
5. Execute the following command in terminal (with the correct path) or open embedded.mobileprovision with the application of your choice, like TextWrangler. You'll find the signing certificate key (or certificates if you used more than one) within the <data> element inside DeveloperCertificates of the PropertyList

   security cms -D -i embedded.mobileprovision

---

In addition, if you want to extract the public key and save it directly to a file, perform the following in terminal:

1. Download and install Homebrew if you haven't installed it already:

   ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go/install)"

2. Install XMLStarlet or any other tool which helps us parse the contents of the plist:

   brew install xmlstarlet

3. Like before, we use the security cms command to decode the embedded.mobileprovision profile, but this time we feed it directly to XMLStarlet (the xml command) to parse the data section of the DeveloperCertificates element, which contains the public key. We read it with openssl and write it to a file, which we call publickey.pem:

   security cms -D -i embedded.mobileprovision | xml sel -t -v "/plist/dict/key[. = 'DeveloperCertificates']/following-sibling::array[1]/data[1]" | awk '{print $1}' | sed '/^$/d' | base64 -D | openssl x509 -inform der > publickey.pem

4. You'll find the public key in the file publickey.pem