9

I'm in the process of release testing a library. The process requires testing on a Jail Broken iOS device. For that, I use an old iPad 1 running iOS 5.1 jail broken with RedSn0w.

RedSn0w does not patch the Gatekeeper service (code signing), so I need to use my developer account and sign the binary I am testing (Absinthe does patch Gatekeeper, and its why you can use ldid to generate phony signatures).

Attempting to sign results in:

$ codesign -s "John Doe" cryptest.exe 
John Doe: ambiguous (matches "Mac Developer: John Doe (3VT8SJ9C5)" and "iPhone Developer:
John Doe (3VT8SJ9C5)" in /Users/jdoe/Library/Keychains/login.keychain)

I made a pass through codesign(1), but I don't how to resolve it since they are the same KeyIDs. Using a KeyID produces the same message.

How do I remove the ambiguity when signing the executable?

0

3 Answers 3

16

Ambiguous Certificates

This happens when two certificates of the same identity are present in the keychain:

The codesign tool requires there only be one.

NOTE: The mention of ldid in your question might need a bit more clarification as to how it relates to your Apple issued codesigning certificates, or what the concern there is exactly.

Duplicate certificates sometimes appear in the keychain as a result of one being expired which was never removed. Apple has some instructions for resolving such issues, although you might need to go a bit outside the normal procedure for resolving it if the following doesn't work:

  1. In Keychain Access, make sure your "View" menu > Show Expired Certificates option is turned ON
  2. Click the "Certificates" 'Category' and then click through every one of the keychains you have listed in your 'Keychain' sidebar in Keychain Access. If you see any duplicates, even expired certificates, delete those duplicates.
  3. Click the "Keys" 'Category' in Keychain Access.
  4. Navigate through every keychain looking for and deleting any "Orphaned Keys" that have the same Common Name as the affected certificate. Orphaned keys are ones that are not bound by a Disclosure Triangle to an iPhone Developer or iPhone Distribution certificate that currently exists in the keychain.
  5. If you found and removed any extra keys or certificates, please reattempt your build.
  6. If the issue persists after removing all active or expired duplicate certificates or keys by the same common name, you might try removing all existing signing certificates and keys and replace them with new ones using the steps in How do I delete/revoke my certificates and start over fresh?.
  7. Finally, if the error persists even after creating new certificates, please control-click on the affected certificate in Keychain Access, choose "New Identity Preference" and click the 'Certificate' field. If you see duplicate certificates listed in here, this is an known and uncommon issue with Keychain Access. To work around the problem, try the following:

    Keychain Access > Edit > Keychain List, uncheck "Shared" for the login keychain.

If going back into the Keychain List you find the login keychain is still marked as Shared, create a backup of the following files and then remove them if they exist:

    /Library/Preferences/com.apple.security-common.plist
    ~/Library/Preferences/com.apple.security.plist

Then retry your build...

If you fail to resolve the issue by the steps above then try searching for one of the certificates listed in the error message. Once you find the certifcate in question delete either the expired one, or the one that is conflicting with the one you need.


Multiple Codesigning Certificates (not duplicates)

If you have multiple codesigning certificates you will want to specify which one to use (if codesigning from the command line) by using the -s option:

codesign -s <certificate name> -vvvv foo.app

-s, --sign identity Sign the code at the path(s) given using this identity. See SIGNING IDENTITIES in man codesign.

Optional:

-v, --verify Requests verification of code signatures. If other actions (sign, display, etc.) are also requested, -v is interpreted to mean --verbose.

For example, in your case:

codesign -s "iPhone Developer: John Doe" cryptest.app
4
  • "Since you're using a phony certificate..." - but these are real, and issued by Apple.
    – jww
    Oct 3, 2015 at 19:01
  • @jww: I was under the impression you were using ldid to generate phony certificates and then using them to codesign things, but I guess that's not the case; that part of your question might need a little clarification perhaps. Regardless see if the procedures outlined helps to resolve things...
    – l'L'l
    Oct 3, 2015 at 19:03
  • No, they are real; sorry about the confusion. If I used Absinthe, then I could use the fake ones. Anyway, I found I had to use the full string: codesign -s "iPhone Developer: John Doe" cryptest.exe. If you want to answer, I'd be happy to accept. I don't ever recall needing to do that. I even documented the other way years ago at iOS (Command Line) on the Crypto++ wiki.
    – jww
    Oct 3, 2015 at 19:25
  • I've always had multiple codesigning certificates and always used the -s option, so i hadn't even considered that really. I've updated the answer to reflect the solution per your comment :)
    – l'L'l
    Oct 3, 2015 at 19:47
2

If you have multiple (conflicted) certificate names, you can create a new keychain and import the desired certificate into it. The "Keychains" list in "Keychain Access" is a sortable list. Therefore be sure your new keychain is at the top of the list.

Then add --keychain <path to new keychain file> to your codesign command line. The path is typically /Users/<username>/Library/Keychains/<keychain name>.keychain-db

1
  • Woa, this is neat! And I believe will solve my challenge. Feb 18, 2020 at 15:40
0

Another way (or hack, at least) to resolve the ambiguity is to create a keychain identity preference.

From the codesign man page (man 1 codesign):

     -s, --sign identity
             Sign the code at the path(s) given using this identity. See
             SIGNING IDENTITIES below.

[...]

SIGNING IDENTITIES

[...]

     The identity is first considered as the full name of a keychain identity
     preference.  If such a preference exists, it directly names the identity
     used.  Otherwise, the identity is located by searching all keychains for a
     certificate whose subject common name (only) contains the identity string
     given.

In the context menu for a certificate in Keychain Access, there is an item New Identity Preference..., where a URL or email address to associate the certificate with can be given. This is meant to allow a client certificate to be used with websites or email accounts, but an arbitrary string works, e.g. codesign-dev-id-app. The string is given directly to the --sign option:

codesign --verbose --sign codesign-dev-id-app --timestamp foo.dmg

This worked for me (on macOS 10.13), whereas putting the certificates and keys in different keychains didn't, even when specifying --keychain explicitly (codesign still looked in all the keychains). The string should probably be chosen carefully to avoid accidental conflicts with its intended purpose. A dummy URL under a domain owned by the developer might be a good candidate.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.