Home/ Questions/Q 5962641
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T19:08:04+00:00

My company uses one build machine (a Mac Mini) as a CI node to

  • 0

My company uses one build machine (a Mac Mini) as a CI node to build our iOS app. We currently build an Ad-Hoc and an App Store config on the mini. We’ve recently enrolled in the Enterprise Program and want to start building an Enterprise config as well. However, our build process now fails, because we now have two certificates called “iPhone Distribution: Widget Corporation”. One is the distribution cert for AdHoc/AppStore, and one is for Enterprise (Apple calls it In-House).

I’ve tried modifying the mini’s keychains such that one cert is in the login keychain and one is in a new keychain called “enterprise”, but this just shifted the error from the start of the build:

CodeSign error: Certificate identity 'iPhone Distribution: Widget Corporation' appears more than once in the keychain.

to the end of the build:

iPhone Distribution: Widget Corporation: ambiguous (matches "iPhone Distribution: Widget Corporation" in /Users/hudson.admin/Library/Keychains/login.keychain and "iPhone Distribution: Widget Corporation" in /Users/hudson.admin/Library/Keychains/enterprise.keychain)

My question is whether or not there’s a way to properly sandbox the two certificates so I can build Ad-Hoc, App Store, and In-House versions of the app on the same machine. The only possible solution I’ve yet to try is to actually bundle the certs along with the source and use security to add and delete the certificates as I need them; clearly that solution isn’t very pretty and poses security risks.

Any ideas?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    After discussing with Apple Developer Technical Support, they’ve advised creating separate keychains to house the different certificates and then pass the --keychain filename argument into the codesign step to point at the appropriate file. You can pass this argument into Xcode or xcodebuild using the OTHER_CODE_SIGN_FLAGS option. eg:

    xcodebuild -target "<targetname>" -configuration "<configname>" \
  PROVISIONING_PROFILE=A3A47A82-E91F-4E95-8559-601C6C857053 \
  OTHER_CODE_SIGN_FLAGS="--keychain=/Users/username/Library/Keychains/enterprise.keychain" \
  build

    Also, after creating a new keychain it seems to default to relocking after 5 minutes – you might want to change this if you have builds that take a while.

    • 0