为 iOS 更新分发证书的正确方法

Proper way to renew distribution certificate for iOS

提问by user1413558

My distribution certificate is expiring on June 7th, along with all of my provisioning files. How do I properly renew it? Should I revoke it now and request a new one? If I do that than will all my live apps be taken down?

我的分发证书以及我的所有配置文件将于 6 月 7 日到期。我如何正确更新它？我现在应该撤销它并申请一个新的吗？如果我这样做，我所有的实时应用程序都会被删除吗？

回答by Andy Obusek

Your live apps will not be taken down. Nothing will happen to anything that is live in the app store.

您的实时应用程序不会被删除。应用商店中的任何内容都不会发生任何变化。

Once they formally expire, the only thing that will be impacted is your ability to sign code (and thus make new builds and provide updates).

一旦它们正式到期，唯一会受到影响的是您对代码进行签名的能力（从而进行新的构建和提供更新）。

Regarding your distribution certificate, once it expires, it simply disappears from the ‘Certificates, Identifier & Profiles' section of Member Center. If you want to renew it before it expires, revoke the current certificate and you will get a button to request a new one.

关于您的分发证书，一旦过期，它就会从会员中心的“证书、标识符和配置文件”部分消失。如果您想在到期前续订，请撤销当前证书，您将获得一个请求新证书的按钮。

Regarding the provisioning profile, don't worry about it before expiration, just keep using it. It's easy enough to just renew it once it expires.

关于provisioning profile，到期前不要担心，继续使用即可。到期后更新它很容易。

The peace of mind is that nothing will happen to your live app in the store.

让您放心的是，您在商店中的实时应用程序不会发生任何事情。

回答by junjie

When your certificate expires, it simply disappears from the ‘Certificates, Identifier & Profiles' section of Member Center. There is no ‘Renew' button that allows you to renew your certificate. You can revoke a certificate and generate a new one before it expires. Or you can wait for it to expire and disappear, then generate a new certificate. In Apple's App Distribution Guide:

当您的证书过期时，它只会从会员中心的“证书、标识符和配置文件”部分消失。没有“续订”按钮可让您续订证书。您可以在证书到期之前撤销证书并生成新证书。或者您可以等待它过期并消失，然后生成一个新证书。在Apple 的 App Distribution Guide 中：

Replacing Expired Certificates

When your development or distribution certificate expires, remove it and request a new certificate in Xcode.

更换过期证书

当您的开发或分发证书到期时，将其删除并在 Xcode 中申请新证书。

When your certificate expires or is revoked, any provisioning profile that made use of the expired/revoked certificate will be reflected as ‘Invalid'. You cannot build and sign any app using these invalid provisioning profiles. As you can imagine, I'd rather revoke and regenerate a certificate before it expires.

当您的证书过期或被吊销时，任何使用过期/吊销证书的配置文件都将反映为“无效”。您不能使用这些无效的配置文件构建和签署任何应用程序。可以想象，我宁愿在证书到期之前撤销并重新生成证书。

Q: If I do that then will all my live apps be taken down?

问：如果我这样做了，那么我所有的实时应用程序都会被下架吗？

Apps that are already on the App Store continue to function fine.Again, in Apple's App Distribution Guide:

已经在 App Store 上的应用程序继续正常运行。同样，在Apple 的 App Distribution Guide 中：

Important: Re-creating your development or distribution certificates doesn't affect apps that you've submitted to the store nor does it affect your ability to update them.

重要提示：重新创建您的开发或分发证书不会影响您提交到商店的应用程序，也不会影响您更新它们的能力。

So…

所以…

Q: How to I properly renew it?

问：如何正确更新？

As mentioned above, there is no renewing of certificates. Follow the steps below to revoke and regenerate a new certificate, along with the affected provisioning profiles. The instructions have been updated for Xcode 8.3 and Xcode 9.

如上所述，没有更新证书。按照以下步骤撤销并重新生成新证书以及受影响的配置文件。Xcode 8.3 和 Xcode 9 的说明已更新。

Step 1: Revoke the expiring certificate

第 1 步：撤销即将到期的证书

Login to Member Center> Certificates, Identifiers & Profiles, select the expiring certificate. Take note of the expiry date of the certificate, and click the ‘Revoke' button.

登录会员中心> 证书、标识符和配置文件，选择即将到期的证书。记下证书的到期日期，然后单击“撤销”按钮。

Step 2: (Optional) Remove the revoked certificate from your Keychain

第 2 步：（可选）从您的钥匙串中删除已撤销的证书

Optionally, if you don't want to have the revoked certificate lying around in your system, you can delete them from your system. Unfortunately, the ‘Delete Certificate' function in Xcode > Preferences > Accounts > [Apple ID] > Manage Certificates… seems to be always disabled, so we have to delete them manually using Keychain Access.app (/Applications/Utilities/Keychain Access.app).

或者，如果您不想在您的系统中放置已撤销的证书，您可以将它们从您的系统中删除。不幸的是，Xcode > Preferences > Accounts > [Apple ID] > Manage Certificates 中的“删除证书”功能似乎总是被禁用，因此我们必须使用 Keychain Access.app (/Applications/Utilities/Keychain Access.app) 手动删除它们。应用程序）。

Filter by ‘login' Keychains and ‘Certificates' Category. Locate the certificate that you've just revoked in Step 1.

按“登录”钥匙串和“证书”类别过滤。找到您刚刚在步骤 1 中撤销的证书。

Depending on the certificate that you've just revoked, search for either ‘Mac' or ‘iPhone'. Mac App Store distribution certificates begin with “3rd Party Mac Developer”, and iOS App Store distribution certificates begin with “iPhone Distribution”.

根据您刚刚撤销的证书，搜索“Mac”或“iPhone”。Mac App Store 分发证书以“3rd Party Mac Developer”开头，iOS App Store 分发证书以“iPhone Distribution”开头。

You can locate the revoked certificate based on the team name, the type of certificate (Mac or iOS) and the expiry date of the certificate you've noted down in Step 1.

您可以根据团队名称、证书类型（Mac 或 iOS）以及您在步骤 1 中记下的证书的到期日期来找到已撤销的证书。

Step 3: Request a new certificate using Xcode

第 3 步：使用 Xcode 申请新证书

Under Xcode > Preferences > Accounts > [Apple ID] > Manage Certificates…, click on the ‘+' button on the lower left, and select the same type of certificate that you've just revoked to let Xcode request a new one for you.

在 Xcode > Preferences > Accounts > [Apple ID] > Manage Certificates…下，点击左下角的“+”按钮，然后选择你刚刚撤销的相同类型的证书，让 Xcode 为你申请一个新的证书.

Step 4: Update your provisioning profiles to use the new certificate

步骤 4：更新您的配置文件以使用新证书

After which, head back to Member Center> Certificates, Identifiers & Profiles > Provisioning Profiles > All. You'll notice that any provisioning profile that made use of the revoked certificate is now reflected as ‘Invalid'.

之后，返回会员中心> 证书、标识符和配置文件 > 供应配置文件 > 全部。您会注意到，任何使用已撤销证书的配置文件现在都显示为“无效”。

Click on any profile that are now ‘Invalid', click ‘Edit', then choose the newly created certificate, then click on ‘Generate'. Repeat this until all provisioning profiles are regenerated with the new certificate.

单击现在“无效”的任何配置文件，单击“编辑”，然后选择新创建的证书，然后单击“生成”。重复此操作，直到使用新证书重新生成所有配置文件。

Step 5: Use Xcode to download the new provisioning profiles

步骤 5：使用 Xcode 下载新的配置文件

Tip: Before you download the new profiles using Xcode, you may want to clear any existing and possibly invalid provisioning profiles from your Mac. You can do so by removing all the profiles from ~/Library/MobileDevice/Provisioning Profiles

提示：在使用 Xcode 下载新配置文件之前，您可能需要从 Mac 清除任何现有的和可能无效的配置文件。您可以通过从~/Library/MobileDevice/Provisioning Profiles

Back in Xcode > Preferences > Accounts > [Apple ID], click on the ‘Download All Profiles' button to ask Xcode to download all the provisioning profiles from your developer account.

返回 Xcode > Preferences > Accounts > [Apple ID]，单击“下载所有配置文件”按钮，让 Xcode 从您的开发人员帐户下载所有配置文件。

回答by leanne

As of January 2020 and Xcode 11.3.1 -

截至 2020 年 1 月和 Xcode 11.3.1 -

• Open Xcode
• Open Xcode Preferences (Xcode->Preferences or Cmd-,)
• Click on Accounts
• At the left, click on your developer ID
• At the bottom right, click on Manage Certificates...
• In the lower left corner, click the arrow to the right of the +(plus)
• Select Apple Distributionfrom the menu

• 打开 Xcode
• 打开 Xcode Preferences (Xcode->Preferences or Cmd-,)
• 点击账户
• 在左侧，点击您的开发者 ID
• 在右下角，单击管理证书...
• 在左下角，单击+（加号）右侧的箭头
• 从菜单中选择Apple Distribution

Xcode will automatically create an Apple Distribution certificate, install it in Keychain Access, and update Xcode's signing information

Xcode 会自动创建 Apple Distribution 证书，安装在 Keychain Access 中，并更新 Xcode 的签名信息

(Note: the single Apple Distributioncertificate is now provided instead of the previous iOS Distributioncertificate and equivalents.)

（注意：现在提供单个Apple 分发证书，而不是以前的iOS 分发证书和等效证书。）

回答by Shanmugasundharam

Very simple was to renew your certificate. Go to your developer member centre and go to your Provisioning profile and see what are the certificate Active and InActive and select Inactive certificate and hit Edit button then hit generate button. Now your certificate successful renewal for another 1 year. Thanks

很简单，就是更新你的证书。转到您的开发人员会员中心并转到您的 Provisioning 配置文件，查看 Active 和 InActive 证书是什么，然后选择 Inactive 证书并点击 Edit 按钮，然后点击 generate 按钮。现在您的证书成功续订了 1 年。谢谢

回答by anoop4real

This was a really a helpful thread, I followed the same steps as @junjie mentioned but for me something weird happened, the below are the steps I did.

这是一个非常有用的线程，我遵循了@junjie 提到的相同步骤，但对我来说发生了一些奇怪的事情，以下是我所做的步骤。

1. Went to developer portal and revoked the certificate which was about to expire.
2. Went to XCode6.4 and in the Account settings, the certificate still showed valid, I went crazy.
3. Then I opened XCode7, there the certificate was shown with "Reset"button instead of create and I hit the reset button and later in the portal I was able to see an extended certificate present. This is what Apple says about Reset button

1. 前往开发者门户并撤销即将到期的证书。
2. 转到XCode6.4，在帐户设置中，证书仍然显示有效，我疯了。
3. 然后我打开 XCode7，证书显示为“重置”按钮而不是创建按钮，然后我点击了重置按钮，稍后在门户中我能够看到存在扩展证书。这就是 Apple 所说的关于“重置”按钮的内容

If Xcode detects an issue with a signing identity, it displays an appropriate action in Accounts preferences. If Xcode displays a Create button, the signing identity doesn't exist in Member Center or on your Mac. If Xcode displays a Reset button, the signing identity is not usable on your Mac—for example, it is missing the private key. If you click the Reset button, Xcode revokes and requests the corresponding certificate.

如果 Xcode 检测到签名身份问题，它会在“帐户”首选项中显示相应的操作。如果 Xcode 显示“创建”按钮，则会员中心或 Mac 上不存在签名标识。如果 Xcode 显示“重置”按钮，则签名身份在您的 Mac 上不可用——例如，它缺少私钥。如果单击“重置”按钮，Xcode 会撤销并请求相应的证书。

1. I tried creating an Appstore ipa with that, just to test and it worked fine so I am saved, but still not sure what has happened. May be I had multiple accounts configured in my Mac, dont know.

4. 我尝试用它创建一个 Appstore ipa，只是为了测试，它运行良好，所以我得救了，但仍然不确定发生了什么。可能是我在 Mac 上配置了多个帐户，不知道。