Checking which distribution certificate signed an .ipa

Hey everyone,


We have an enterprise developer account and have two distribution certificates. Both are expiring in 2016, one in February and one in November of 2016. The problem is that we have lost the private key associated with the November cert so it cannot be used to sign .ipa's.


We have 3 apps deployed to end users using an MDM solution, and with our distribution certificate expiring soon, we want to revoke the incomplete November cert (because Apple only lets us have two active distribution certs) and create a new one to sign our apps. The problem is that we are not sure which certificate was used to sign the apps, it could be the February one or it could be the November one before the private key was lost. Thus, we are hesitant to revoke the November one in case an app was actually signed with that certificate and becomes non-functional.


Thus, my question is, is there a way to check which certificate was used to sign an .ipa? I have been able to find commands for the terminal such as codesign -dvvv <path_to_embedded_provision>/ but the output of this is only the name of the cert and the timestamp for when it was signed. This information is not helpful as both our certs are named identically, and we are not sure when we lost the November private key so we can't use this timestamp to compare. In addition, I found another command: security cms -D -i <path_to_.app_file>/ which gives information about the mobile provisioning profile such as its expiration date. If only there was a similar function for the distribution certificate.


Please let me know if you know of a way to solve this problem.


Thanks!

To identify the signing cert:


$ unzip -q MyApp.ipa

$ codesign -d --extract-certificates Payload/*.app

$ openssl x509 -inform DER -in codesign0 -out codesign0.pem

$ openssl x509 -inform DER -in codesign1 -out codesign1.pem

$ openssl x509 -inform DER -in codesign2 -out codesign2.pem

$ cat codesign1.pem codesign2.pem > cachain.pem

$ openssl x509 -inform DER -in codesign0 -noout -nameopt -oneline -subject -serial -dates

subject= /UID=RGDRCE4A47/CN=iPhone Distribution: MobileIron, Inc./OU=RGDRCE4A47/O=MobileIron, Inc./C=US

serial=1DA1FD38F1737D34

notBefore=Aug 5 16:08:00 2014 GMT

notAfter=Aug 4 16:08:00 2017 GMT


Before revocation:


$ openssl ocsp -issuer cachain.pem -cert codesign0.pem -url `openssl x509 -in codesign0.pem -noout -ocsp_uri` -CAfile cachain.pem

Response verify OK

codesign0.pem: good

This Update: Nov 13 21:25:00 2015 GMT

Next Update: Nov 14 21:25:00 2015 GMT


After revocation:


$ openssl ocsp -issuer cachain.pem -cert codesign0.pem -url `openssl x509 -in codesign0.pem -noout -ocsp_uri` -CAfile cachain.pem

Response verify OK

codesign0.pem: revoked

This Update: Nov 13 21:22:16 2015 GMT

Next Update: Nov 14 21:22:16 2015 GMT

Reason: keyCompromise

Revocation Time: Jan 30 05:41:40 2013 GMT

Thanks a lot cliff!


Do you know how long a revoked cert stays cached on an iOS device? I've been seeing articles saying the cert is cached for 3-7 days unless the device is restarted but I'm getting different results where an app signed with a revoked cert still launches on my iOS device despite rebooting and reinstalling the device.

Did you receive an answer on how long a revoked iOS distribution certificate stays cached?

Nope.

I was able to use c l i f f's instructions, but needed a bit of an adjustment: the OCSP URL required we include the "Host" header in our request, and I found this answer which mentions the undocumented "-header" option.


According to my certificate, the OCSP URL to contact was "http://ocsp.apple.com/ocsp03-wwdr01", so I went ahead and added "-header ocsp.apple.com" to the command and it worked.


Thanks for the original answer, by the way. There are not many resources (or tools) that allow us to validate a given App Signing certificate.

Checking which distribution certificate signed an .ipa
 
 
Q