Managing P12 Certificates & Profiles in CI/CD

Understanding PKCS#12 (.p12) Archives

A PKCS#12 file is an encrypted archive format that bundles a private RSA/ECDSA key alongside its associated public X.509 certificate chain. In iOS development, `.p12` files represent signing identities exported from macOS Keychain Access or generated via Apple Developer API.

Ephemeral macOS Keychains in Build Runners

To avoid polluting shared system keychains or leaving private keys exposed on build servers:

• Create a temporary keychain using `security create-keychain -p passphrase build.keychain`.
• Import the P12 file using `security import identity.p12 -k build.keychain -P p12_password -T /usr/bin/codesign`.
• Set access control locks and automatically delete `build.keychain` upon job teardown.

Provisioning Profile Validation

Provisioning profiles (`.mobileprovision`) are DER-encoded CMS signed messages. Before initiating build signing, utilities extract the inner XML plist using `security cms -D -i profile.mobileprovision` to verify bundle identifiers, team IDs, and expiration dates.