Can't submit Mac OS X Binary: Apple claims the “wrong” certificate was used to sign the binary

2
votes

Following Apple's instructions, I cannot upload my app to the Mac App Store.

Symptoms:

  1. When I submit my app, I get an automated email from Apple that claims I signed it with the "wrong" certificate. The email says I must use the "3rd Party Mac Developer Installer" certificate - which I did.

  2. Xcode4 forces me to use the "Installer" certificate - it has no other options in the drop-down

  3. If I run codesign from the command line, I actually get an error message: "this identity cannot be used for signing code"

Things I've tried, with no success:

  1. Asking Apple for help (after 1 week, I got an email saying they would get back to me)
  2. Deleting all my certificates, rebooting, creating new certificates from Apple, trying again
  3. Exporting UNsigned from Xcode4, signing with codesign on the commandline, and submitting with Application Loader
  4. Signing inside Xcode4, then submitting with Application Loader (fails because Xcode refuses to even TRY to sign with the Installer cert)

NB: the app itself works fine and is tested on multiple machines - if I do "Share..." and save to disk as a mac .app, I can email that to friends etc and everythign works fine.

Finally, Apple's automated-email:

Invalid Signature - This error occurs when you have signed your app's installer incorrectly. There are two certs required for this process: the "3rd Party Mac Developer Application" cert and the "3rd Party Mac Developer Installer" cert. When signing your package, you need to ensure that you are using the Installer cert to sign your package. Ensure that you are specifying this cert when submitting your app via the Xcode Organizer or when running productbuild from the command line.

2
macosapp-store

2 Answers

2
votes

Ah, found the problem: Apple's error message is wrong :).

What they meant to say (correction in italics) was:

"When signing your package, you need to ensure that you are using the Developer cert during the Xcode4 build phase, and then the Installer cert to sign your package"

Also, with Xcode4, the binary you upload will ONLY use the settings for "Release", so make sure that you've set "Release" to "Codesign using Developer cert", and then when you go to submit (from inside Xcode4), ALSO select "Codesign using Installer cert" (should be the only option - Xcode4 knows it cannot use a Developer cert at this point)

0
votes

when Xcode tell you to use the "3rd Party Mac Developer Installer" certificate but you can't find it in "Build Settings" --> "Code Signing Identity", you're going to the wrong place.

Select it when submitting app in Organizer.

In Xcode 4, when you're at the step choosing Application name and Identity, you select "3rd Party Mac Developer Installer" as Identity. Check this post and see @nacho4d's answer.

In Xcode 5, when selecting Identity, if you're one of the team developer, you should select the Your Company Name as the installer certification.