Certificate-and-profile-installer problem with converting file p12 to pem

Hi I have generated the certificate using the Codesigndoc and set the password empty however im still having the p12 to pem conversion error.
I also tried manually export my .p12 file with a password and added my password in the settings, still no luck. Is there anything I am missing, i will appreciate your help
Thanks.

+------------------------------------------------------------------------------+
| (4) certificate-and-profile-installer@1.8.8                                  |
+------------------------------------------------------------------------------+
| id: certificate-and-profile-installer                                        |
| version: 1.8.8                                                               |
| collection: https://github.com/bitrise-io/bitrise-steplib.git                |
| toolkit: go                                                                  |
| time: 2017-09-21T09:32:48-07:00                                              |
+------------------------------------------------------------------------------+
|                                                                              |
INFO[09:32:48]  * [OK] Step dependency (go) installed, available. 
Configs:
 - CertificateURL: https://www.bit***772
 - CertificatePassphrase: ***
 - ProvisioningProfileURL: file://Las***ile
 - DefaultCertificateURL: 
 - DefaultCertificatePassphrase: ***
 - DefaultProvisioningProfileURL: 
 - KeychainPath: /Users/vagrant/Library/Keychains/login.keychain
 - KeychainPassword: ***
Provided Certificate count: 1
Provided Provisioning Profile count: 1
Keychain already exists, using it: /Users/vagrant/Library/Keychains/login.keychain
Downloading & installing Certificate(s)
=> Downloading certificate: 1/1
   Downloading (https://www.bit***772) to (/var/folders/90/5stft2v13fb_m_gv3c8x9nwc0000gn/T/bitrise-cert-tmp477574318/Certificate-0.p12)
=> Installing downloaded certificate
Failed to convert .p12 certificate to .pem file, out: 1436:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/crypto/asn1/tasn_dec.c:1344:


1436:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/crypto/asn1/tasn_dec.c:387:Type=PKCS12, error: exit status 1
|                                                                              |
+---+---------------------------------------------------------------+----------+
| x | certificate-and-profile-installer@1.8.8 (exit code: 1)        | 5.76 sec |
+---+---------------------------------------------------------------+----------+
| Issue tracker: .../bitrise-io/steps-certificate-and-profile-installer/issues |
| Source: ...s://github.com/bitrise-io/steps-certificate-and-profile-installer |
+---+---------------------------------------------------------------+----------+

Where does the .p12 coming from? Did you set a custom URL to download it from?

From this log snippet and from what you wrote my best guess is that the file is not available on the specified URL, and instead of an actual .p12 file the downloaded “file” (response from the server) is something like an XML file with “Unauthorized” or similar content.

Hi Victor,
Thanks for the help. I figured out what i was doing wrong. Have a great day.
Keran

Glad to hear @borg666! :slight_smile:

Can you share a short summary here? Just so that we can mark that as an “answer”, if you have some time :slight_smile:

Basically i tried to specify a file location like this file://certificate.p12 instead of the default $BITRISE_CERTIFICATE_URL in the step settings.
first it failed because it could not download and I was not sure if this was the correct way of pointing to a uploaded certificate file. then i used the download url https://www.bitrise.io/build_certificate/xxxx which was not the ideal solution but, i just wanted to see if download was working, and then it failed with the .p12 to pem conversion, without password. in the settings. Once I reverted back to $BITRISE_CERTIFICATE_URL and $BITRISE_CERTIFICATE_PASSPHRASE in the step settings, i realized that Bitrise was clever enought to figure out which certificate and provisioning profiles to use from the uploaded ones.

Got it, thanks @borg666 for the details! :slight_smile:

1 Like

Hi,

apologies if this isn’t the right place, but from the couple of very short threads I’ve searched, they all seemed to point here.

Currently our organisation’s builds are coming with this error:
Failed to convert .p12 certificate to .pem file, out: Mac verify error: invalid password?, error: exit status 1

The build is the vanilla Bitrise workflow, with the environment variables configured as in post #5. The certificates and provisioning profiles were exported using the codesign tool provided by Bitrise

At this point, just trying to figure out if I missed something during the basic setup steps.

Default Certificate given
Provided Certificate count: 2
Default Provisioning Profile given
Provided Provisioning Profile count: 3
Keychain already exists, using it: /Users/vagrant/Library/Keychains/login.keychain
Downloading & installing Certificate(s)
=> Downloading certificate: 1/2
   Downloading (https://con***5be) to (/var/folders/90/5stft2v13fb_m_gv3c8x9nwc0000gn/T/bitrise-cert-tmp102136574/Certificate-0.p12)
=> Downloading certificate: 2/2
   Downloading (https://s3-***p12) to (/var/folders/90/5stft2v13fb_m_gv3c8x9nwc0000gn/T/bitrise-cert-tmp102136574/Certificate-1.p12)
=> Installing downloaded certificate
Failed to convert .p12 certificate to .pem file, out: Mac verify error: invalid password?, error: exit status 1
|                                                                              |
+---+---------------------------------------------------------------+----------+
| x | certificate-and-profile-installer@1.8.8 (exit code: 1)        | 5.46 sec |

Hi @Alexei,

Are you sure that the password you did set on bitrise.io for the uploaded certificate is valid?

If you used our codesigndoc tool to export the .p12 then the password should be empty / no password should be set.

Hi @viktorbenei,

I checked a few times and it appears so.

Currently, when I upload the .p12 file it sets the pwd to the password for my Bitrise acct. I’m not sure if that’s the intended behaviour but I re-run the codesigndoc tool just to make sure. The dashboard wouldn’t let me delete the password either - if I tried to remove it and leave it blank, the password would just reappear when I tried to save the change.

Apologies if it’s some newbie thing on my behalf. Still learning my way around :slight_smile: I used the auto-provisioning step in another project instead, which actually got me around the signing issue, perhaps that’s a better approach.

@Alexei we’ll check the UI but indeed it might have been that Chrome (I guess, as Chrome is the most aggressive with filling password type inputs…) auto filled that password field with the login psw, even though we marked the input field to not to auto complete / auto fill…

The auto-provisioning step should also be fine - did that help? Or do you still have issues with this? :slight_smile:

Apologies for the late reply, we seem to have solved this by using the auto provisioning step :slight_smile: Thanks for the help!

1 Like

Glad to hear, thanks for reporting @Alexei! :slight_smile: