Xcode Code Sign error because of no Keys in Keychain

Question

You might think, not again such a question where are already thousands of topics about. However, I've not been capable of finding the answer I needed to fix this problem.

None of these topics go as deep as the Keychain.

When I'm trying to deploy my app to an iPhone, I'm receiving the following message:

Code Sign error: The identity 'iPhone Developer: [Name] ([ID])' doesn't match any valid, non-expired certificate/private key pair in your keychains.

Now, as said, I have been looking for multiple guides or fixes, however, none of them seemed to fix this issue.

Things I've tried:

• Use Apple's walkthrough for app deployment for countless of times
• Searched the internet for guides for app deployment
• Changed the content of the 'pbxproj' file inside the 'xcodeproj' package.
• Retrieve all available profiles from Apple's server using the Refresh button in Xcode 4.6 (allows you to obtain automatically)

After trying all of these ways, I've still not been able to solve the issue. One problem I've seen is that at first hand, the certificate in the Keychain was showing an invalid status, which is now solved.

However, if I'm right, there are supposed to be two keys attached to the certificate. A public and private key, and these are not showing.

Neither are there any keys showing in the Keys tab in the Keychain Access.

---

Solution

(Thanks to nsgulliver)

1. Do everything what the post (marked as Solution) of nsgulliver says.
2. If you already have an active Certificate, click the Revoke button, this won't cause any trouble, you'll simply have to re-create the keys of which then will be generated a new certificate.
3. Make sure you have the WWDR of Apple installed to mark the certificate authority as valid.
4. Follow the default Provisioning Assistant guidelines.

Kind

Apparently WWDR is to expire soon and Apple wants the updated one to be installed. However, if I simply removed WWDR from keychain, XCode installs the old one instead of the newer one. That makes newly generated profiles not trusted, though generated via XCode or the portal and there is no clue given about why. Getting newer WWDR online solves the problem. – Deel

Answer 1

Provisioning profiles installed on the devices or signed with for the target might not be valid, try to go to Organizer->Provisioning profile and see if the profiles have the valid status? if not try to delete & refresh them, if they appear valid after refreshing then it might solve your problem if not then you should remove all the entries from keychain and delete profiles on your provisioning portal and try to create from scratch, if you still face the problem then take help from step by step guide tutorial

Richardricharda

This is partly the same as the fourth option, no they did not indicate valid in this screen. I'll have to start from scratch i think, is there a website which exactly guides me from step to step?? Since i'm in some sort of tunnel vision and i'm keeping to make the same mistake over and over again.. – Kind

check my answer, i have written in the last line link step by step guide, you could follow it and it has two parts – Richardricharda

I have been in this situation, reason might be that you created the provisioning profiles first time, and then you lost your keychain values but profiles in provisioning profile still exists, only solution at the end was start from scratch by deleting keychain values and profiles from provisioning portal. – Richardricharda

Perhaps a dumb question.. but do you also have to delete the 'active' provisioning profiles? Which also includes the 'iOS Team Provisioning Profile' , which indicates it is managed by Xcode ? – Kind

I am not sure but I as I remember I deleted everything and started from scratch, it wont hurt, everything will comes normal if you follow the right steps, if you face problems then you are welcome, and if you find my answer useful then you could accept also thanks – Richardricharda

Do i need to delete the 'Current Developments Certificates' too? -- and yes, i will mark your answer as solution.. but not yet while i'm busy and the problem isn't solved yet – Kind

yes you can delete and start from scratch, just follow the tutorial, it will guide you as you want – Richardricharda

I'll be tomorrow morning at my work again, i'll notify of any changes :) – Kind

Haven't recieved permission from my employer to clean up the entire account yet, since he would first like to get it touch with his contacts, still awaiting permission. I'll inform you asap :) – Kind

Problem solved. I'll add the solution + extra to the end of my question :) – Kind

Solution is not working for someone who does not have paid account, as there is no certificate tab visible. So looks Apple does not want me to code, – Provo

Answer 2

You cannot re-create matching keys, that would defeat the whole purpose of them. You need to find the old keys or start the signing procedure from scratch.

Are you using the same machine that you generated the keys on? If not, go to the other machine, export the developer profile, then import it on the new machine.

Can you restore the keys from backups? If not, stop everything you are doing and configure your computer for backups before you do anything else.

If you are really stuck, you will have to follow the signing procedure right from the very beginning, where you request a certificate from a certificate authority. This will generate new keys, and you will have to create matching provisioning profiles, then set your application to be signed with these. Dlete the old provisioning profiles, they will be useless without the old keys.

Sunder

No, A few months ago I've tried deploying too, but it didn't work out for me for the same reason. Then another employer took the project home and tried to deploy there, which succeeded. Now it is the case, that he has the keys, but has quit his job, and so i'm not capable of obtaining those keys. Would it hurt the apple developer account if i delete everything in it, except for the registred devices? – Kind

You can't delete everything in the account, nor do you need to. Just create a new key pair, certificate and provisioning profile. Delete the old provisioning profiles, and you should be set. – Sunder

Answer 3

Required reading when you're having code signing problems:

Technical Note TN2250: iOS Code Signing Troubleshooting

Nothing will help you more than really understanding what's in your certificates and what isn't, where the necessary pieces are kept, and how they're used. This isn't the last time that you'll have code signing issues, and this tech note provides a long checklist that should help you make sure that everything is in the right place to help you develop your app and ultimately sign and submit it to the app store.

Horned

Answer 4

You need to lock keychain. Please see screenshot:

Chiarra

And if "Lock keychain login" is greyed out? – Procrustes

Answer 5

When I've had this problem in the past I've just deleted everything on my local machine and started again. So:

1. Delete the keys associated with your developer account in Keychain access.
2. In XCode open the 'Organizer' (window->organizer)
3. In Devices (top menu) and Provisioning Profiles (left menu), select all of the profiles and delete them.
4. Now hit refresh. It will ask you to sign in and whether you want to generate new keys etc, select yes and wait.

I find that this is the quickest way to fix any provisioning / key problems, as you can spend hours finding that you've missed something small.

Spun

This was the fourth option i've tried, it didn't ask me however to generate new keys,, it simply retrieved all items from the remote apple server. – Kind

Ah ok. This means that you haven't deleted everything in your keychain yet. Have you deleted the developer certificates? As the generation of these causes a new key pair to be created. – Spun

Yes, i had deleted all developer related certificates, the one i didn't delete was the overall developer certificate from apple.. MWSDDN or something like that.. – Kind

I don't have "devices" menu in organizer. – Provo

Answer 6

After removing all old provisioning profiles (~/Library/MobileDevice/Provisioning Profiles/) and updating xCode, the certificates can be found again.

Tyrolienne

Xcode 11.2 your solution not works. Xcode tries to create new developer certificate and fails in infinite loop – Provo