"iPhone Distribution" certificate is not trusted

Question

I just installed a new iPhone Distribution certificate that was exported as a .p12 from someone else's computer.

When I try to archive with a provisioning profile that's tied to this new certificate I get this Invalid trust settings error:

Restore system default trust settings for certificate "iPhone Distribution" in order to sign code with it.

However, when I Repair Trust Settings, which sets the Trust Settings for the certificate to "Use System Defaults", it says that the certificate is not trusted:

iPhone Distribution certificate is not trusted

If I try to archive in this state, I get this error:

Warning: unable to build chain to self-signed root for signer "iPhone Distribution"

And I'm stuck in an infinite loop. Please help!

Haiphong

Double-click to open the distribution certificate, flip open the Trust part, and change the Trust setting to Always Trust. Does that fix it? If not, maybe you need a new Apple Worldwide Developer Relations Certification Authority certificate; has yours expired? If so, get a new one at the Member Center. – Costive

Changing it to "Always Trust" results in the first error: Invalid Trust Settings. Then it says it needs to use "Use System Defaults". Maybe I'll try updating my Apple Worldwide Developer Relations Certification Authority certificate. – Haiphong

Answer 1

Trust in an Apple certificate is provided through the Apple Worldwide Developer Relations Certification Authority certificate. It sounds like you don't have one. It looks like this:

If you don't have one of those, get it from the Apple Developer Member Center. Even if you do have one, try downloading a newer one.

Costive

I do have one, when I search in "All Items", it says it's in the System keychain, as well as the login keychain. – Haiphong

Has it expired? They do that sometimes. – Costive

It's not expired. I updated the question to show the Certificates category instead of My Certificates. – Haiphong

Hmm. What about what I suggested in my comment? – Costive

Thanks for your help. I just installed the latest worldwide cert (expiring 2030) and now my distribution certificate is trusted. Why wouldn't the one expiring in 2023 work though? – Haiphong

They do go bad from time to time. — Added to my answer the suggestion to get a new one in any case; that way, this Q&A will be more useful to posterity. – Costive

This worked when I downloaded the Certificate which expires in 2/20/2030. The 2023 certificate did NOT work. – Prehistoric

Same thing worked for me, Downloading 2/20/2030 from Apple's Certificate Authority magically fixed my issue. Why the f**** does this solve the issue?!?! – Sempstress

I faced a similar issue. however, even after downloading Apple's certificate authority and after moving the distribution profile to LOGIN keychain, I still get this error. Can anyone help please ? – Carrelli

Answer 2

I had the Apple Worldwide Developer Relations Certification Authority certificate that expires on Feb 7, 2023 at 3:48:47 PM.

My issue was resolved when I installed the one that expires on Feb 19, 2030 at 6:00:00 PM.

You can download either one of those here: https://developer.apple.com/account/resources/certificates/add

Haiphong

I don't know how to thank you bro you solved my issue that was driving me crazy ! – Pantaloon

Thank you !!! This was really obscure and downloading the newer one fixed my issue. – Boiling

Answer 3

After not getting any luck downloading the Apple Worldwide Developer Relations Certification Authority certificate 2030, what worked for me was going to the system keychain and searching for the certificate that was having trouble (something like 5CTYZUT475) and I changed the always trust to use system defaults.

Migdaliamigeon

Immediately worked for me, thanks! I did like you said, in Keychain, I entered part of the Cert name it gave into the search box. double clicked to get-info, expanded Trust, changed top one to system default, closed, saved. Tried again, worked. – Thereby

After chaning this to System defaults, it keeps asking me for my domain login password repeatedly while I am archiving my app. To change this, I check it to "Always trust", but, doing so, results in "Iphone distribution certificate is not trusted ". I again run into the same problem. Can anyone help ? – Carrelli

Answer 4

If it's Mac,

1. Right click certificate in KeyChain and go to getInfo
2. Expand Trust
3. Change 'Always trust' to 'system default'

For this error that fixed for me.

Nickinickie

Answer 5

Anyone from 2024:

To use your certificates, you must have the intermediate signing certificate in your system keychain. This is automatically installed by Xcode. However, if you need to reinstall the intermediate signing certificate click the link below:

1. Worldwide Developer Relations Certificate Authority https://developer.apple.com/certificationauthority/AppleWWDRCA.cer
2. Worldwide Developer Relations Certificate Authority https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
3. Worldwide Developer Relations - G4 https://www.apple.com/certificateauthority/AppleWWDRCAG4.cer
4. Developer ID - G2 https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer

NB: TO INSTALL THE ABOVE CERTIFICATES INTO YOUR KEYCHAIN SIMPLY DOUBLE CLICK ON THEM

Reube

Answer 6

None of the above worked for fixing my "Developer ID Application" showing up as not trusted.

Turns out there was a different intermediate certificate called "Developer ID - G2 (Expiring 09/17/2031)" that I needed. Available for direct download from here.

Archoplasm

Answer 7

in my case, it was command-line tools that were missing. I think command line tools automatically downloads worldwide certificate.

So I go to XCode preferences, then locations, and in command-line tools selected 13.3.

'Quit' Xcode relaunch XCode. Quit keychain and relaunch keychain. And now my ios distribution certificate was trusted.

Prentice

Answer 8

For me it was helped installing new apple root certificate. Direct link which could be found here. Which could be found from that support page.

Swede