Apple Development Certificate not trusted - no root cert found even though they are installed

Question

I am trying to codesign an app and receive the following error:

Warning: unable to build chain to self-signed root for signer "Apple Development: John Smith (########)"

The Apple Development certificate I'm using is not trusted, and when I evaluate it, it tells me that there is No Root Certificate found. However, I have the following unexpired certificates on my machine:

Apple IST CA 2 - GA
Apple Root CA
Apple Root Certificate Authority
Apple Worldwide Developer Relations CA - G2
Apple Worldwide Developer Relations Certificate Authority

Can anyone shed light on why my Apple Development Cert is not trusted / no root cert found when the root certs are installed?

When I evaluate the Apple Root CA it tells me that the cert is valid, but "Root ALSO in System Roots". Is this a problem?

Thanks in advance.

Signing Certificates

12k

Posted by

riotchild

Reply

I had this happen to me today. I went into Keychain Access and noticed I had an expired personal developer certificate that was being referenced by our distribution certificate. I also had multiple personal developer certificates that were not expired. All the distribution certificates were showing as "Untrusted" in Keychain.

I deleted the expired personal certificate, then all the distribution certificates came up as "Trusted." I then re-opened Xcode and successfully built an Archive of my current project for distribution on the App Store.

—
Soonerwolf

Add a Comment

Answer 1

The most common cause of this is that someone has set custom trust settings on the leaf, the intermediate, or the root. Run Keychain Access, open each of those certificates, and check their trust settings (disclose the Trust section and make sure the “When using this certificate” popup is set to “Use System Defaults” and all the other popups are set to “no value specified”).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

Posted by

eskimo

Add a Comment

Answer 2

Thanks Quinn,

This advice prompted me to reinstall my certs and the issue has been fixed.

However, my Apple Development Cert now has the green tick and "Certificate is Valid" - but when I evaluate it (generic) Certificate Status reports "Good", but Evaluation Status reports "No root certificate found".

I am trying to notarise an app with this cert and I am getting the error "The binary is not signed with a valid Developer ID certificate." Even though:

Code Block security find-identity -v -p codesigning

returns a valid identity, and I'm guessing the notarise error is due to the missing root cert.

Posted by

riotchild

Add a Comment

Answer 3

To clarify, none of the certs had custom trust settings, I fixed the issue by deleting all the apple-related certs and re-downloading them.

Posted by

riotchild

Add a Comment

Answer 4

I've checked each certificate and they all have trust settings as “Use System Defaults” for “When using this certificate” and “no value specified” for the other pop-ups.

Evaluation (generic) of my Apple Development Certificate (not expired) returns

Evaluation Status: No Root Certificate Found
Certificate Status: Good

Evaluation (generic) of my Apple Worldwide Developer Relations Certification Authority (not expired) returns

Evaluation Status: No Root Certificate Found
Certificate Status: Good

Posted by

riotchild

Add a Comment

Answer 5

I solved this issue, well, it turns out there was no issue. I successfully signed and released an app even though the certificate I used to sign it was 'untrusted' and had no root certificate. Neither of these issues prevented the certificate from working as it should.

Posted by

riotchild

Add a Comment

Answer 6

The same thing just happened to me and freshly made dev and distro certs are all not trusted. Even reinstalled the Apple WWDRCA cert and all of my dev and distro certs are "not trusted" with "no root certificate found".

My dec
Common Name: Apple Worldwide Developer Relations Certification Authority
Organizational Name: G3
Organization: Apple Inc.

Does that mean that the root cert needs to be in the keychain? Because it is and it's valid. There are no certs that are expired or certs with custom trust settings in my keychain.

Posted by

azav

Add a Comment

Answer 7

Well, it appears that there is another AWWDCRA cert that is required.

One that expires on Feb 7, 2023 and one that expires on Feb 19, 2030.

Copy and paste the following link to see. i.imgur.com/XiicKhc.png

Installing the cert below made my freshly created certs become trusted.

https://developer.apple.com/support/expiration/

Posted by

azav

Add a Comment

Answer 8

I also got hit by this issue, even after re-installing Apple's root certificates.

My workaround is to delete my development certificate from the keychain, download it from the developer web site, and re-install it.

The developer certificate will then be trusted for the remainder of the day.

However, the next morning it is not trusted again!

So I have to apply this workaround every morning... Huh?

What's the proper fix?

Posted by

phirk

Add a Comment

Answer 9

Thank you azav ... solved my problem.

An excerpt from that link:

The current Apple Worldwide Developer Relations Certification Intermediate Certificate (intermediate certificate) is set to expire on February 7, 2023. The renewed certificate will be used to sign new software signing certificates issued after January 28, 2021 for the Apple Developer Programs.

https://developer.apple.com/support/expiration/

There is even a spot on the page to click which simply downloads the new AppleWWDRCAG3.cer file to your Mac for you to double-click (which installs it to Keychain). With the new cert in place (expiring Feb 19, 2030), the Apple Development cert I just created immediately became valid.

Posted by

sseitz

Add a Comment

Answer 10

Today I even had to re-install the certificate 3 times! (instead of once every day...)

Any fix for this?

(I already have all Apple certificates installed)

Posted by

phirk

Any update on this issue? I have the very same problem as @phirk and I have to generate new certificate in Xcode every single day. I have number of Development Certificates installed in keychain from different teams and they look the same, but the one is always untrusted.

—
antonm76
Not sure whether this is relevant, but I noticed that some "Apple Worldwide Developer Relations Certification Authority" certificates are in my "System" keychain, while others are in the "login" keychain... Does this matter? If so, what's the proper keychain for these certificates?

—
phirk

Add a Comment

Answer 11

Two more colleagues are now suffering from this issue. Any updates?

Posted by

phirk

Add a Comment

Answer 12

I had this exact issue (4 of my dev certificates were shown as untrusted) and the issue was solved by downloading The Worldwide Developer Relations - G3 (Expiring 02/20/2030 00:00:00 UTC) cert from (thanks azav)

https://www.apple.com/certificateauthority/

After clicking on the link, the Cert file gets downloaded. Click on it (which will give you an option to install in the Keychain). Once installed all my certs are shown with green checkmarks. YAY! I can now embark on another journey of signing my electron app... Its good to be equipped with right certs for that journey as I have a feeling it will be an uphill climb...

Posted by

gkacy

Thank you! It helped me

—
vitalysw

Add a Comment

Apple Development Certificate not trusted - no root cert found even though they are installed

Replies