Posted on 05-26-2020 08:35 AM
Howdy,
I have a strange problem that just cropped up and I've tried to get apple to help and well, they were useless.
I suddenly can no longer manually sign mobile configs with my developer certificates.
typically and the way it's always worked for me before was to use this command: productsign --sign "Developer ID Installer: John Wells (SERIAL)" /Users/jwells/Desktop/TEST.mobileconfig ~/Desktop/signed.mobileconfig
And the profile would sign without issue.
Now I get this error: productsign: error: Can't read input product archive "/Users/jwells/Desktop/TEST.mobileconfig"
Additionally, I have tried Profile Creator and I get this error:
errSecInternalComponent
Verify the ACL of the private key of the selected certificate in "Keychain Access.app". Toggle the ACL setting and save to refresh update the private key access.
I've also tried the security command to sign it and get this error:
security: failed to encode data: unknown error -1=ffffffffffffffff
This has me stumped and as most of you know, some profiles when uploaded to the JSS need to be signed or the JSS breaks them.
I tried all the usual troubleshooting:
locking/unlocking keychain
creating a new keychain and reinstalling my certs
creating a new cert and using that
using a another computer and trying that, etc
Has anyone else encountered this issue and if so, did you find a way to fix it?
Thanks in advance!
Posted on 07-20-2020 12:01 PM
I had a similar problem using ProfileCreator. For whatever reason, Catalina is particularly fussy about certificate signing but I found a link to another application called Hancock that appears to work while adding minimal extra steps. https://github.com/JeremyAgost/Hancock
(found via this Github support comment https://github.com/ProfileCreator/ProfileCreator/wiki/Profile-Signing-with-Certs-on-10.15-Catalina)