This certificate has an invalid issuer Apple Push Services

Question

I have created certificate to enable Push Services in my app, but every time I try to add certificate in my Keychain, after adding certificate it shows me following error:

This certificate has an invalid issuer

Solution 1

I think I've figured this one out. I imported the new WWDR Certificate that expires in 2023, but I was still getting problems building and my developer certificates were still showing the invalid issuer error.

• In keychain access, go to View -> Show Expired Certificates. Then in your login keychain highlight the expired WWDR Certificate and delete it.
• I also had the same expired certificate in my System keychain, so I deleted it from there too (important).

After deleting the expired certificate from the login and System keychains, I was able to build for Distribution again.

Solution 2

1. Download https://developer.apple.com/certificationauthority/AppleWWDRCA.cer and double-click to install to Keychain.
2. Select "View" -> "Show Expired Certificates" in Keychain app.

3. Confirm "Certificates" category is selected.

   

4. Remove expired Apple Worldwide Developer Relations Certificate Authority certificates from "login" tab and "System" tab.

---

Here's Apple's answer.

Thanks for bringing this to the attention of the community and apologies for the issues you’ve been having. This issue stems from having a copy of the expired WWDR Intermediate certificate in both your System and Login keychains. To resolve the issue, you should first download and install the new WWDR intermediate certificate (by double-clicking on the file). Next, in the Keychain Access application, select the System keychain. Make sure to select “Show Expired Certificates” in the View menu and then delete the expired version of the Apple Worldwide Developer Relations Certificate Authority Intermediate certificate (expired on February 14, 2016). Your certificates should now appear as valid in Keychain Access and be available to Xcode for submissions to the App Store.

https://forums.developer.apple.com/thread/37208

Solution 3

This is not actually a development issue. It happens due to expiration of the Apple Worldwide Developer Relations Intermediate Certificate issued by Apple Worldwide Developer Relations Certificate Authority. WWDRCA issues the certificate to sign your software for Apple devices, allowing our systems to confirm that your software is delivered to users as intended and has not been modified.

To resolve this issue, you have to follow the below steps:

1. Open Keychain Access
2. Go to View -> Show Expired Certificates

3. Go to System in Keychain

4. Here you find that "Apple Worldwide Developer Relations Certificate Authority" is marked as expired. So delete it. Also check under Login Tab and delete expired WWDRCA.

5. Download new WWDR Intermediate Certificate from here(The renewed Apple Worldwide Developer Relations Certification Intermediate Certificate will expire on February 7, 2023).

6. Install it by double clicking on it.

If you still face any issue with your iOS apps, Mac apps, Safari extensions, Apple Wallet and Safari push notifications, then please follow this link of expiration.

The Apple Worldwide Developer Relations Certification Intermediate Certificate expires soon and we've issued a renewed certificate that must be included when signing all new Apple Wallet Passes, push packages for Safari Push Notifications, and Safari Extensions starting February 14, 2016.

While most developers and users will not be affected by the certificate change, we recommend that all developers download and install the renewed certificate on their development systems and servers as a best practice. All apps will remain available on the App Store for iOS, Mac, and Apple TV.

Solution 4

Here is how we fixed this.

Step 1: Open Keychain access, delete "Apple world wide Developer relations certification authority" (which expires on 14th Feb 2016) from both "Login" and "System" sections. If you can't find it, use “Show Expired Certificates” in the View menu.

Step 2: Download this and add it to Keychain access -> Certificates (which expires on 8th Feb 2023).

Step 3: Everything should be back to normal and working now.

Reference: Apple Worldwide Developer Relations Intermediate Certificate Expiration

Solution 5

In Apple's Developer's portal, add a new certificate, and when asked "What type of certificate do you need?" choose "WorldWide developer relations certificate". Generate the new certificate, download and install. The moment you do that, you will no longer see the message you have described.

Edit:
The certificate can be downloaded from the following page: https://www.apple.com/certificateauthority/ You can choose one of the following two certificates: "WWDR Certificate (Expiring 02/07/23)" or "WWDR Certificate (Expiring 02/14/16)"

View more solutions

Comments

[matt]

developer.apple.com/support/certificates/expiration

[Avaan]

check this one stackoverflow.com/a/35406327/5512225

[Ian Ringrose]

Note to people voting to close: This is on-tropic because it is about a TOOL that PROGRAMMERS use.

[David]

Readers should note that this problem is not specific for Push Services, but is found equally for expired iOS and Mac Developer and Distribution certificates. (The solutions work equally well for these.)

[Sajjon]

Congrats on most relevant question, this Q is linked to by industry-standard CI tool for iOS fastlane during the step for downloading code signing identities called Match.

[Aamir]

there is no such option appears when we add new certificate

[Mr Zorn]

downloaded and installed the new cert but still having the same issue - anything else have to do?

[superarts.org]

@MrZorn I'm having the same problem, but just FYI I tried to export the p12 and it worked anyway.

[dfmuir]

Thank you very much. This worked for me as well. It is important to remove the expired certificate from both the login and System keychains.

[sudoExclaimationExclaimation]

Thank you! this worked perfectly for me. Once I enabled Show expired certificates, there were login and system certs which expired today - February 14, 2016. I was able to delete them and add the WWDR cert from your link. After that it worked perfectly!

[markdwhite]

Had followed previous advise to delete based on 'Show Expired Certificates', but had only done Login. Also deleting from System did the trick.

[Tj3n]

@MrZorn U need to go View -> show expried -> del the old WWDR cert

[Soufiane.ess]

please note, that you need to remove it also from System as well

[CoBrA2168]

For me, I already had the new certificate (that expires in 2023), but I also had the old one that had expired. Both were in my System keychain. Once I removed the old certificate, I was able to build using my Distribution cert.

[HughHughTeotl]

It was the system thing that did it for me too. Apple really screwed up here - without SO there would simply be no way of finding this answer.

[Nitish]

Deleting expired certificate from System is rather most important.

[ashish]

Deleting expired Apple Worldwide Developer cert from key chain only helps but some times keychain does not show up you have quit and open key chain then search again Apple Worldwide Developer and make sure you should be selecting Allkeys. It took hell lot of time to fix this because expired Apple Worldwide Developer cert was still appearing after many deletions.

[NoBugs]

Maybe worthwhile to note that there is a similar bug in Keychain in which exporting p12 of an item will export the old expired one, unless you delete your old one. If you don't believe it verify with a Java or Python p12 reader.

[Nazik]

Do I need to export the apple push service certificate newly after doing these above steps and upload them in my server? suddenly push notifications are not working.

[Preetam Jadakar]

need to ensure that its really get deleted..now worked. Thanks.

[CocoaBean]

That's funny. I had problems with that certificate too, but in a other way

[o.shnn]

I got stuck where I should have removed the old certificate - couldn't do it due to UNIX permissions error - and this thread just saved my life: stackoverflow.com/questions/35511314/…

[o.shnn]

I got stuck in the part where I should have removed the old certificate - couldn't do it due to UNIX permissions error - and this thread just saved my life: stackoverflow.com/questions/35511314/…

[o.shnn]

I got stuck trying to remove the old certificate - couldn't do it due to UNIX permissions error - and this thread just saved my life: stackoverflow.com/questions/35511314/…

[o.shnn]

I got stuck where I should have removed the old certificate - couldn't do it due to UNIX permissions error - and this thread just saved my life: stackoverflow.com/questions/35511314/…

[Martin]

Like you said, this is not a solution. But it's still interesting, that why I won't downvote.

[Marc Endtricht]

The full name of the expired certificate you're looking for is "Apple Worldwide Developer Relations Certificate Authority.

[hellojinjie]

followed your steps, did not work... After reboot my mac, It worked.Thank you

[Bradley Thomas]

Important to note that "Show expired Certificates" must be checked in the Menu in order to be able to see the ones that need to be deleted

[Hardik Vyas]

Thanx Thanx Thanx Man

[tyegah123]

I was frustrated for a whole friggin' day and turned out I only have to delete one expired certificate. Really nice.

[Lyndsey Ferguson]

This answer helped me, but I wasn't seeing the problem from the Keychain Access app, but from the CI build that uses the security cmd. When CI imported a certificate and tried to use "system find-identity -v keychain" it reported 0 valid identities. Without the "-v" option, it showed the identity, but with a suffix: CSSMERR_TP_CERT_EXPIRED. That initially made us think the cert had expired, but it had not. It wasn't until I tried manually adding the cert to the keychain on the failing machine that we saw that the issuer had expired. Hopefully, this comment helps someone in the same situation.

[Kreutzer]

For me it worked right after installing new WWDR Certificate that expires in 2023. Thanks!

[Ben Stahl]

Thank you, this worked great. Before deleting that cert, I had Reset buttons in Xcode Accounts next to my signing identities, but pressing them did nothing. After deleting the expired "Apple world wide Developer relations certification authority" certificate, I was able to press Reset on each item in Xcode and it cleared it (the Reset button went away). On a side note...my god Apple, can you not make this stuff work better? I swear tens of thousands of hours of developer time have been wasted on these insane certificate/profile/signing issues...just make it work!!

[Ankit]

How would I ensure this step is taken care of if I am to run a macOS runner using Github actions workflow?

[Ankit]

How would I ensure this step is taken care of if I am to run a macOS runner using Github actions workflow?

[Ankit]

How would I ensure this step is taken care of if I am to run a macOS runner using Github actions workflow?

[Ankit]

How would I ensure this step is taken care of if I am to run a macOS runner using Github actions workflow?

[Ankit]

How would I ensure this step is taken care of if I am to run a macOS runner using Github actions workflow?

[Ankit]

How would I ensure this step is taken care of if I am to run a macOS runner using Github actions workflow?

[Ankit]

How would I ensure this step is taken care of if I am to run a macOS runner using Github actions workflow?

[adee]

I get this error on import_certificate. security: SecKeychainItemImport: Write permissions error. and getting the same error on get_certificate: Could not create another Distribution certificate, reached the maximum number of available Distribution certificates @Cyril any thoughts?

[Cyril Cermak]

Hi @adee, do you have the keychain unlocked? You can have a look here; docs.fastlane.tools/actions/unlock_keychain. In my case, I always create a new keychain and I never experienced such errors. Maybe you can try something like that.