How to install new Apple Worldwide Developer Relations Intermediate Certificate on air gapped Mac?

user_310121 0
Viewed 2296

As you may or may not be aware, new signing certificates are now generated with a new intermediate certificate. You can read about it here:

https://developer.apple.com/support/wwdr-intermediate-certificate/

For Macs that are connected to the Internet, Xcode will download the new intermediate certificate automatically. However, our build nodes are not connected to the Internet, so we can't get the certificate automatically.

I'm struggling to find any documentation on how to do this manually (or automated with Ansible if possible).

code-signing certificate xcode macos ios
1 Answers

You can download the certificate from here: https://www.apple.com/certificateauthority/

Direct link: https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer

Then you can install it with this command:

security add-trusted-cert -d -r unspecified -k ~/Library/Keychains/login.keychain-db ~/Downloads/AppleWWDRCAG3.cer

Edit: Found out that it should be added to the login keychain and not the system keychain. Also, the trust settings matter. It should be unspecified, because if it is trusted, the code signing thinks that it's a self signed certificate and fails.

user_3101210
Related