Cannot generate Apple Passbook signature

Question

I am writing a shell script to automatically generate an Apple Passbook signature file from manifest.json using p12 certificate. Here is what I do:

openssl pkcs12 -passin pass:"mypass" -in "mycert.p12" -clcerts -nokeys -out certificate.pem
openssl pkcs12 -passin pass:"mypass" -in "mycert.p12" -nocerts -out key.pem
openssl smime  -passin pass:"mypass" -binary -sign -signer certificate.pem -inkey key.pem -in manifest.json -out signature -outform DER

The first two functions work fine. At least both certificate.pem and key.pem are created. The signature file is also created, but for some reason it is empty (0 bytes), although manifest.json is not empty, as well as certificate and key. How can this happen, and how can I fix it?

Concussion

What messages do you get from openssl when running these commands? – Xerox

I didn't get any error message. Just the resulting file was empty. I have posted the solution below. – Concussion

For me the 2 first commands work (at least I think they do because I get the 2 pem files) but then the 3rd one returns "unable to load certificates". So confusing. Any idea what it might be? :( – Ravishment

Answer 1

I have solved this problem. Apparently, I also need WWDR.pem certificate to do this. This is how it worked:

openssl pkcs12 -passin pass:"somepass" -in "mycert.p12" -clcerts -nokeys -out certificate.pem
openssl pkcs12 -passin pass:"somepass" -in "mycert.p12" -nocerts -out key.pem -passout pass:"somepass"
openssl smime -binary -sign -certfile WWDR.pem -signer certificate.pem -inkey key.pem -in manifest.json -out signature -outform DER -passin pass:"somepass"

Concussion