Fix: Missing Private Key for Distribution Certificate in Keychain Access

Why this happens

When you download a distribution certificate (.cer file) from Apple Developer portal, that file contains only the public certificate. It does not contain your private key. Code signing requires a cryptographic pair: the public certificate issued by Apple and the private key that stays securely on the machine where the Certificate Signing Request (CSR) was originally created.

When a team lead or colleague creates an Apple Distribution certificate using Keychain Access on their Mac, their macOS Keychain automatically generates a 2048-bit or 256-bit key pair. The private key never leaves their machine unless explicitly exported. If they simply download the .cer file from the developer portal and send it to you, your Mac cannot link it to any local private key.

Without that private key, Keychain Access displays the certificate as a flat item without an expandable disclosure arrow. Consequently, Xcode cannot build a valid signing identity (Apple Distribution: Company Name (TEAMID)), meaning your distribution provisioning profile will appear invalid or remain hidden in archive export dialogs.

How to fix it

1. Export the Certificate and Private Key as a .p12 Identity

This is the fastest and cleanest fix when you have access to the Mac that generated the original certificate request.

1. On the Mac where the certificate was created, open Keychain Access (found in /Applications/Utilities/).
2. In the sidebar, select login under Default Keychains and switch to the My Certificates tab.
3. Locate the distribution certificate (typically named Apple Distribution: Team Name or iPhone Distribution: Team Name). Click the small arrow next to it to verify that the private key appears nested underneath.
4. Highlight both the certificate and the nested private key (or simply select the parent certificate item).
5. Right-click and choose Export “Apple Distribution: …”.
6. In the dialog:
   – Set the file format to Personal Information Exchange (.p12).
   – Choose a save location and click Save.
   – Enter a password to protect the .p12 container. You will need this password on the destination machine.
   – If macOS prompts for your local Mac login password to authorize exporting the private key, enter it and click Allow.
7. Transfer the .p12 file to your Mac.
8. On your Mac, double-click the .p12 file, enter the password you set during export, and ensure it imports into the login keychain.
9. In Keychain Access, verify that the certificate now has a disclosure arrow showing the private key beneath it.

Once imported, restart Xcode or open Xcode > Settings > Accounts, select your Apple ID, click Manage Certificates, and verify that Xcode identifies the certificate as locally installed.

2. Export and Import Developer Accounts via Xcode

If your team lead prefers to avoid manual Keychain exports, Xcode provides a built-in mechanism to bundle all developer signing identities and provisioning profiles into a single file.

On the team lead’s Mac:
1. Open Xcode > Settings (or press Cmd + ,).
2. Select the Accounts tab.
3. In the lower-left corner of the accounts list, click the gear icon and select Export Developer Accounts….
4. Specify a filename, set an encryption password, and click Save.

On your Mac:
1. Open Xcode > Settings > Accounts.
2. Click the gear icon in the lower-left corner and select Import Developer Accounts….
3. Select the file, enter the password configured during export, and click Open.

Xcode automatically imports the required certificates, private keys, and intermediate developer authorities into your login keychain.

3. Create a Second Distribution Certificate (Without Revoking the Original)

If the original Mac was wiped, decommissioned, or the private key is permanently lost, you do not need to revoke the existing distribution certificate. Revoking an active certificate can disrupt continuous integration pipelines or other team members who are actively shipping updates.

Apple Developer accounts allow multiple distribution certificates per team (typically up to 3 or 4 depending on account tier):

1. On your Mac, open Keychain Access.
2. In the menu bar, go to Keychain Access > Certificate Assistant > Request a Certificate From a Certificate Authority….
3. Enter your email address, enter your name as the Common Name, leave the CA Email blank, and select Saved to disk.
4. Click Continue to save the CertificateSigningRequest.certSigningRequest file.
5. Log in to Apple Developer.
6. Click the blue plus button (+) to create a new certificate.
7. Select Apple Distribution and click Continue.
8. Upload the CSR file created in step 4 and click Continue.
9. Download the generated .cer file and double-click it. Because the CSR was generated on your Mac, Keychain Access automatically joins the certificate to your local private key.
10. Update your distribution provisioning profiles (or regenerate them in the developer portal) to include this new certificate.

How to prevent it

• Back up signing identities immediately: Whenever a new distribution certificate is generated, immediately export it as a .p12 file and store it in your team’s secure secrets manager or encrypted shared vault.
• Use cloud-managed signing or fastlane match: Tools like fastlane match store your private keys and certificates in an encrypted Git repository or cloud storage bucket, ensuring every team member and CI runner uses the exact same keys without manual transfers.
• Avoid revoking team certificates: Always check the number of active distribution certificates in your Apple Developer account before revoking. In most cases, creating a secondary certificate prevents breaking existing automated release pipelines.
• Maintain designated build machines: Designate a central build machine or CI/CD runner to manage production distribution identities rather than distributing distribution keys across individual developer laptops.

FAQ

Will revoking a distribution certificate break apps already published in the App Store?

No. Apps already published and live on the App Store will continue to work normally for users. However, revoking the certificate will immediately invalidate any developer-signed ad-hoc builds, in-house enterprise distributions, and currently active CI/CD upload scripts using that certificate.

Why does my imported .cer file not have a disclosure triangle in Keychain Access?

A .cer file only contains the public certificate issued by Apple. Keychain Access only displays a disclosure triangle when the corresponding private key—generated during the initial CSR creation—is already present in your local login keychain.

What permissions are needed to export a .p12 file from Keychain Access?

You must have administrative or local account access to the Mac where the private key was created, as macOS will prompt for that user’s login password before allowing Keychain Access to read and export the private key data.