Sunday, January 5, 2014

Certificate issues - what else is new?

One of the reasons I dread making changes to my IOS program is that there is virtually always some kind of issue with provision profiles and developer certificates and distribution certificates and so on and so on. It's absolutely maddening! But what can you do? You just have to try to figure it out.

My latest idea is try to research the issues to the max possible before going to code, or trying the fix. The key to software is understanding. You have to let the light of knowledge guide you. It's about *process* - not results. Enjoy the process, and things between you and your computer will go a lot easier. Stop worrying so much about having it *done*, and concern yourself with *understanding*. If you do so, eventually the picture clears up and you have a better idea how to proceed.

So, first off, what it the error message I'm dealing with now?

"No provisioning profiles with a valid signing identity (i.e. certificate and private key pair) were found."

"No codesigning identities (i.e. certificate and private key pairs) that match the provisioning profile specified in your build settings (“JlptProfileForIphone”) were found.  Xcode can resolve this issue by downloading a new provisioning profile from the Member Center."

So, let's take it one step at a time. I have a "ProvisioningProfile" named "JlptProfileForIphone" specified in my build settings.

It's trying to find a "codesigning identity", which is a "certificate and private key pair" that matches it, and doesn't (find it, that is).

Ok, so in reviewing a previous blog I made, called "Provisioning Profiles - a labor of love",
I discovered this information:

"To run an application you're developing for iPhone, iPad or iPod touch, you must have a Provisioning Profile and a Development Certificate installed on your device and your Mac. The Provisioning Assistant will guide you through the steps to create and install your Development Provisioning Profile and iOS Development Certificate."

Also, "A Provisioning Profile is a collection of your App ID, Apple device UDID, and iOS Development Certificate that allows you to install your application on your device."

Also, I want to make sure my developer id is still valid.  Well, I after logging into the portal, it looks like I'm still good for that. But I got an email a month or so ago stating:

"Your iOS Distribution Certificate will expire in 30 days"

"This certificate will no longer be valid in 30 days. To create a new certificate, visitCertificates, Identifiers & Profiles in Member Center.

Certificate: iOS Distribution Certificate
Team Name: 98X643NLB6

To learn more about expired certificates, visit the certificates support page."

Which just happens to be 30 days to the day. 

But, before I go there, let's note this: on that blog, I used the assistant to create a provision profile called "JlptProfileForIphone".  The I picked my phone, a 4S, called "Mark Donaghue’s iPhone". 

Umm, I just noticed, though, when I look at my devices, that my phone is "no longer connected". Could this be the problem? I need to use iTunes (btw - why a music player for all this complicated software connection stuff?) to reconnect. But, if I take the plunge and do that, it tells me I have purchased items I need to transfer. Hmmm...why isn't that being handled automatically? 

So - now I have to decide if I should go down that route, or stick with learning about the expired certificates. It could fix it - or it could make it worse. Usually, I'd stick without making the change, under the theory that I need to keep the variables reduced. But I did see something on SO that talked about this problem being caused be a change to IOS7. 

So, let's just hold off on that for now. I'm still dealing with the disconnected issue. 

Also, why is the certificate name "IOS distribution certificate"? Should it be under my name or my app name or something? 

Ok, there are a few things to follow up on:

1) The email telling me that my certificates are going to expire
2) From the developer site, I have two certificates - developer and distribution. They're called IOS Developer and IOS Distribution. And they both don't expire until Jan, 2016.

3) I have 4 app IDs:
name                                     id 
com.kanjisoft.jlptvocabquiz -  com.kanjisoft.jlptvocabquiz
JLPT Vocabulary Quiz App       com.kanjisoft.JlptVocabularyQuiz

And a couple more unrelated.  

4) I have 3 devices - my iphone, my ipod, and a borrowed iPhone 5. 

5) I have a 8 provision profiles - 6 development profiles, and two distribution profiles. Both distribution profiles are expired as of Jan 1, 201. 

JLPT Vocabulary Quiz App Profile  JLPT Vocabulary Quiz App (com.kanjisoft.JlptVocabularyQuiz)
JlPTVocabQuizDistributionProfile    JlptVocabQuiz (*)


So now, my question is - what app Id is the one in the store? And what provision am I using for it? 

So, according to my last blog entry - and the error message - the provisioning profile FOR DEVELOPMENT is "JlptProfileForIphone".  

And the appid associated with it, (this is coming from "https://developer.apple.com/account/ios/profile/profileList.action"

"JlptVocabQuiz (*)"

Ok, so ideally, those are the only two I should care about. 

Now, back to the "expiring IOS distribution certificate". Is that one of the two from above? What was the identifier? 

Certificate: iOS Distribution Certificate
Team Name: 98X643NLB6

Well, that's the prefix for all my my JLPT apps. But, again, the IOS Distribution Certificate says it's not expired until 2015 - same as the development certificate. 

Btw, here's another piece of info. This came from the email warning me about the expiring IOS distribution certificate:

I received an error message saying, "Xcode could not find a valid private-key/certificate pair for this profile in your keychain." What should I do?

This error message indicates that your Mac's Keychain is missing either the public or private key for the certificate you are using to sign your app.
This often happens when you are trying to sign and build your app from a different Mac than the one you originally used to request your code signing certificate. It can also happen if your certificate has expired or has been revoked. Ensure that your app's provisioning profile contains a valid code signing certificate, and that your Mac's Keychain contains that certificate, the private key originally used to generate that certificate, and the WWDR Intermediate Certificate.
For instructions on how to resolve this error, review the Code Signing support page.
So, Mac's keychain is missing the public or private key for the certificate I'm using to sign the app. So, I'm not sure if it's the developer or the distribution but I'm guessing it's the developer, since that's what I'm using to try to build the app. 

It would happen if I'm on a different mac because...the keychain won't be there. That's not the problem, I've only ever had this mac. So, maybe that revocation warning somehow took effect, although the site states it's valid through 2015. Why? 

Anyway, the solution looks onerous: 

Ensure that your app's provisioning profile contains a valid code signing certificate, 

and that your Mac's Keychain contains that certificate, 

the private key originally used to generate that certificate, 

and the WWDR Intermediate Certificate.

Yikes.  I have vague recollections about this stuff. There's a .provision somewhere. But, with the new xcode, it was supposed to be managed from Organizer, too. 

Well, let's follow the Code Signing  link. 

"

Code Signing

Overview

Code signing your app assures users that it is from a known source and the app hasn’t been modified since it was last signed. Before your Mac app or iOS app be can used with store services, installed on an iOS device for development or testing, or submitted to the App Store, it must be signed with a certificate issued by Apple. For more information on how to request certificates and code sign your apps, review the App Distribution Guide.

This has a very back-to-square-one look to it. 

Ok, if I go back to the original error, it says: "a valid signing identity could not be found". So, what if I download the certificate for development that's supposedly valid? 

When I do that, it took me to the list of certificates in keychain. Some of them are expired, but a few aren't. So, then when I try to build, and get the error about invalid key, and choose fix, and select whatever it was I selected - suddenly it goes into seemingly successful build, which asks for access to the keychain and everything. Now, this might have worked from the get-go, but I didn't know what to choose. Anyway, it's alway better to *understand* as much as you can about what your dealing with. In the end, you know more, and you save time - sometimes a lot. The computer likes it when you try to understand her.