When updating our Developer ID Application certificate, we encountered an issue where the Apple Developer portal consistently returns the exact same certificate file, regardless of the CSR submitted.
Observed Behavior & Test Steps:
We generated multiple new CSRs using both OpenSSL in the command line and Keychain Access (Certificate Assistant) on macOS following Apple's official guide: https://developer.apple.com/help/account/certificates/create-a-certificate-signing-request
We uploaded these distinct CSRs to the Developer Portal (Certificates -> Add New -> Developer ID Application) on separate attempts.
After downloading the issued .cer files, we performed a binary comparison (diff/checksum) across all of them. The comparison confirmed that the downloaded certificate files are 100% binary identical across all attempts.
Key Pairing Verification:
To further verify the key pairing, we checked the public key modulus hashes of the local Private Key and the downloaded .cer file via OpenSSL:
Check local Private Key Modulus Hash:
openssl rsa -noout -modulus -in new_developer_id.key | openssl md5
Check downloaded Certificate Modulus Hash:
openssl x509 -noout -modulus -in developer_identity.cer -inform DER | openssl md5
The resulting MD5 hashes do not match. Attempting to export them to PKCS#12 (.p12) consistently fails with the error:
no certificate matches private key.
Question:
Could this be related to a profile caching or binding issue on our team account, or is there a recommended way to clear this state and obtain a newly issued certificate?
Any guidance or advice would be greatly appreciated.
Thanks for that info. Your description of your situation matches my view of your account. Specifically, I see four valid Developer ID Application certificates, all of which expire on 2031-09-15. Their hex serial numbers are:
2DC1________________________3A2139C0________________________CFD70DD8________________________42AD5A78________________________8038
Because we are aware of the strict limit on Developer ID certificates, we halted further attempts
Wise move!
Currently, we see 4 Developer ID Application certificates listed under our Team ID in the portal.
OK. If you click on one it shows the certificate info plus a Download button, right? And your problem is that each of those Download buttons yields the same certificate, right?
Each of those certificate info pages should have a unique URL. For example, I see this:
https://developer.apple.com/account/resources/certificates/download/43L673H5XU
where 43L673H5XU identifies my specific certificate. Do you see different identifiers for each of the four certificates?
On the certificate info page, when you hover over the Download button, the Safari status bar (choose View > Show Status Bar if it’s not visible) shows the download action URL. For example, in my case I see a URL like this:
https://developer.apple.com/services-account/QH65B2/account/mac/certificate/downloadCertificateContent.action?
teamld=SKMME9E2Y8
&certificateld=43L673H5XU
&type=3RA4WT43AH
The certificateId parameter should be different for each of the four certificates, and match the last path element of the certificate’s download page. Is that what you see?
Also, in Xcode > Settings > Apple Accounts > YOUR_ACCOUNT > YOUR_TEAM you’ll see a Manage Certificates button. If you click that, does the resulting sheet show four Developer ID Application certificates?
If so, try secondary clicking and choosing Export Certificate on each one. Does that yield four copies of the same certificate? Or the four new ones?
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
