How to get a valid (trusted) distribution certificate?

Hello, I am a C# developer trying to use .NET Maui to developer iOS app. I'm really good at SQL and C#, but not so good at all the app publishing steps. I am trying to create an app build to publish an iOS app in the App store for our company. I am trying to follow various "recipes" for doing so. In youtube videos, the experts have this all done in under 20 minutes. Unfortunately I've wasted a couple of days in fits-and-starts and getting stuck, like now, because I don't know how this all fits together, and I never get to the end of a process without either an error, or a deviation of the documentation from the real apps.

I am at the point where I need to create a distribution certificate. I have created a certificate request, uploaded it, and received a certificate from apple for "iPhone Distribution". I double-clicked the certificate on my Mac after downloading it. I can see it in the Keychain Access -> Certificates. However, it says "certificate is not trusted". I see reference pointing me to developer.apple.com/support/expiration. This is WAY over my head.
What do I need to do in order that my certificate status changes from "red" to "green", and my certificate is trusted? Why doesn't the certificate that Apple generates simply come down as valid, good, and green? I don't understand (a) why it doesn't come down as trusted, like in all the sample pages and videos I see, and (b) if there is something I need to do, what am I supposed to do, and why is it necessary I do it? At the developer.app.com/support/expiration site, I click another link (it seems to be what I should do???) https://www.apple.com/certificateauthority/ And here is a whole list of certificates. Which do I pick, and why do I pick that? And why doesn't this "fix" just get baked into the certificate that I just downloaded from Apple?

However, it says "certificate is not trusted".

You need to install the appropriate WWDR intermediate certificate. I go into this in depth in Fixing an untrusted code signing certificate.

And why doesn't this "fix" just get baked into the certificate that I just downloaded from Apple?

There are two reasons for this:

  • The .cer file you download from Apple can only hold a single certificate.

  • At a more meta level, most folks using Xcode and it installs the required intermediate for you.

It’d be cool if the Developer website had a “Download Intermediate” button next to the “Download” button that returned the correct intermediate for your certificate. If you’d like to see such a feature added in the future, I encourage you to file an enhancement request describing your issue.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

How to get a valid (trusted) distribution certificate?
 
 
Q