Skip to main content

Apple signing

iOS Certificate Generator

Create an iOS distribution or development certificate without a Mac. Generate the Certificate Signing Request (CSR) and private key here, upload the CSR to Apple, and turn the issued certificate into a .p12 file for signing.

  • Create an Apple-ready CSR without Keychain Access or a Mac, from Windows, Linux, or macOS.
  • Works for Apple Distribution (App Store, TestFlight, ad hoc) and Apple Development certificates.
  • Convert the issued .cer to .p12 right on this page, in your browser, for Xcode, fastlane, CI, or Capgo Cloud Build.
Generate CSR now See the step-by-step guide

Workflow

  1. 1. Enter the certificate subject details you want attached to the signing request.
  2. 2. Download the CSR and matching private key.
  3. 3. Upload the CSR in Apple Developer when creating your certificate.
  4. 4. Convert the issued .cer and the private key into a password-protected .p12 in step 2 below.

Step 1

Generate the CSR and private key

Use the same person or organization identity you want represented in the Apple certificate request.

Output

Your generated signing request

Nothing is shown until the CSR is generated. Once ready, download both files and store the private key securely.

Generate a certificate request to see the subject summary and download buttons here.

Step 2

Convert your Apple .cer to .p12

After Apple issues your certificate, combine the .cer with the private key from step 1 to get a password-protected .p12 for Xcode, fastlane, CI, or Capgo Cloud Build.

Runs entirely in your browser. Your certificate, private key, and password are read locally and never uploaded to any server.

The distribution.cer or development.cer file from Apple Developer. DER and PEM are both accepted.

The ios-private-key.pem file downloaded with the CSR you uploaded to Apple.

Output

Your .p12 signing identity

Select your .cer and private key, set a password, and build the .p12. It uses 3DES encryption with a SHA-1 MAC, the format macOS Keychain and Xcode accept.

Basics

What is an iOS signing certificate?

Apple requires every iOS app to be code signed. A signing certificate proves the build comes from a member of your Apple Developer team, and iOS refuses to install or launch apps whose signature it cannot trust.

Getting one takes three files. The CSR (.csr) holds your public key and identity and goes to Apple. The private key (.pem) stays with you. The certificate (.cer) is what Apple issues back. Build tools then need the certificate and private key together as a .p12 file.

On a Mac, Keychain Access creates the CSR and hides the private key in your login keychain. This generator gives you both files directly, so you can create an Apple Distribution or Apple Development certificate from Windows, Linux, or a CI runner, and you always know where the key is.

Security and privacy

How your private key is handled

  • The CSR and RSA 2048-bit private key are created on demand by a stateless Capgo endpoint over HTTPS and returned directly to your browser.
  • Responses are sent with Cache-Control: no-store. Nothing is saved to a database or kept after the response.
  • The CSR is signed with SHA-256, the format Apple Developer expects. Only the CSR is uploaded to Apple; the private key stays with you.
  • The .cer to .p12 converter runs entirely in your browser. Your certificate, private key, and password are never uploaded.
  • No account or sign-up is required, and requests are rate limited to prevent abuse.

Prefer to generate the key locally? This OpenSSL command produces the same two files.

Equivalent OpenSSL command
openssl req -new -newkey rsa:2048 -nodes \
  -keyout ios-private-key.pem \
  -out ios-certificate-request.csr \
  -subj "/emailAddress=jane@company.com/CN=Jane Doe/C=US"

Step by step

How to create an iOS distribution certificate without a Mac

From CSR to a signed build on TestFlight. Every step works from a browser and a terminal on Windows, Linux, or macOS.

  1. Step 1

    Generate the CSR and private key

    Enter your name, email, and two-letter country code in the form above and select Generate CSR and private key. Download both files and keep the private key safe.

  2. Step 2

    Create the certificate in Apple Developer

    Sign in to developer.apple.com, open Certificates, Identifiers & Profiles, select the plus button, and choose Apple Distribution or Apple Development.

  3. Step 3

    Upload the CSR and download the .cer

    Upload the ios-certificate-request.csr file, continue, and download the issued certificate, usually named distribution.cer or development.cer.

  4. Step 4

    Convert the .cer to a .p12 file

    Use the .cer to .p12 converter in step 2 of this page: select the .cer and the private key, set a password, and download the .p12. It runs in your browser, or use the OpenSSL command instead.

  5. Step 5

    Create a provisioning profile

    In Apple Developer, create an App Store, ad hoc, or development provisioning profile for your App ID and select the new certificate.

  6. Step 6

    Sign and ship your app

    Import the .p12 and profile into Xcode, fastlane, your CI secrets, or Capgo Cloud Build, then build and upload your app to TestFlight or the App Store.

Use the output

Sign your iOS app with the .p12

The fastest path is the in-browser .cer to .p12 converter above. Prefer the command line? OpenSSL does the same job; it asks for an export password that becomes your .p12 password.

Create the .p12 with OpenSSL

OpenSSL is preinstalled on macOS and most Linux distributions, and available on Windows through Git Bash or WSL.

Convert .cer to .p12
# 1. Convert Apple's DER .cer to PEM
openssl x509 -inform DER -in distribution.cer -out distribution.pem

# 2. Bundle the certificate and private key into a .p12
#    -legacy (OpenSSL 3) keeps the file compatible with macOS Keychain.
#    Drop it on OpenSSL 1.1 or LibreSSL, which do not support the flag.
openssl pkcs12 -export -legacy \
  -inkey ios-private-key.pem \
  -in distribution.pem \
  -name "Apple Distribution" \
  -out distribution.p12

Capgo Cloud Build

Save the .p12 and provisioning profile once and let Capgo Cloud Build sign and upload iOS builds, no Mac required.

Capgo CLI
bunx @capgo/cli@latest build credentials save \
  --platform ios \
  --certificate ./distribution.p12 \
  --p12-password "your-p12-password" \
  --ios-provisioning-profile "com.example.app=./profile.mobileprovision" \
  --apple-team-id "TEAM123456"

fastlane and Xcode

On a Mac, double-click the .p12 to import it into Keychain and Xcode picks it up. On a CI runner, import it into a temporary keychain with fastlane.

Fastfile
import_certificate(
  certificate_path: "distribution.p12",
  certificate_password: ENV["P12_PASSWORD"],
  keychain_name: "build.keychain",
  keychain_password: ENV["KEYCHAIN_PASSWORD"]
)

CI secrets and key checks

Encode signing files for GitHub Actions or GitLab secrets, and confirm the certificate matches the private key.

base64 and OpenSSL
# Encode the .p12 and profile for CI secrets
base64 -i distribution.p12 | tr -d '\n' > p12.base64
base64 -i profile.mobileprovision | tr -d '\n' > profile.base64

# Check that the certificate and key match (both hashes must be equal)
openssl x509 -noout -modulus -in distribution.pem | openssl md5
openssl rsa -noout -modulus -in ios-private-key.pem | openssl md5

Troubleshooting

Common iOS certificate errors and fixes

The password you entered is incorrect (Keychain import)
OpenSSL 3 encrypts .p12 files with algorithms that macOS Keychain can reject. Re-export the .p12 with OpenSSL 3 and the -legacy flag shown above.
No certificate matches private key
The .cer was issued for a different CSR. Use the private key downloaded with that exact CSR, or revoke the certificate and start again with a new CSR.
unable to load certificates
Apple delivers .cer files in DER format. Add -inform DER when converting the .cer with openssl x509.
Provisioning profile does not include signing certificate
Profiles are tied to specific certificates. Edit or regenerate the provisioning profile after creating the new certificate, then download it again.
You have reached the maximum number of certificates
Apple limits how many distribution certificates a team can hold. Revoke an unused one in Apple Developer. Live App Store apps are not affected.
Certificate is not trusted in Keychain
Install the current Apple Worldwide Developer Relations (WWDR) intermediate certificate from Apple PKI, then import the .p12 again.

After signing

Ship web fixes without another store round-trip

Once the native binary is signed, Capgo live updates can deliver Capacitor web-layer changes over the air—channels, rollback, and any CI/CD you already use. Free to try when you are ready to wire OTA into the same release path.

FAQ

iOS certificate generator FAQ

Answers about CSRs, certificate types, .p12 conversion, Apple Developer accounts, and signing iOS apps without a Mac.

What does this iOS certificate generator create?

It creates a Certificate Signing Request (.csr) and the matching RSA 2048-bit private key (.pem). Upload the CSR to Apple Developer to get your Apple Distribution or Apple Development certificate (.cer), then combine the .cer with the private key into a .p12 file for Xcode, fastlane, CI, or Capgo Cloud Build.

What is a Certificate Signing Request (CSR)?

A CSR is a small file that contains your public key and identity details (name, email, country), signed with your private key. Apple uses it to issue a signing certificate bound to that key. The private key never goes to Apple, which is why you must keep the .pem file this tool gives you.

Can I create an iOS distribution certificate without a Mac?

Yes. Generate the CSR and private key here, upload the CSR in the Apple Developer portal from any browser, download the .cer, and convert it to .p12 with the converter in step 2 of this page. Everything works from Windows, Linux, or macOS, so Keychain Access is not required at any step.

Which certificate type should I choose in Apple Developer?

Choose Apple Development to run builds on registered test devices from Xcode. Choose Apple Distribution to sign builds for the App Store, TestFlight, and ad hoc distribution. The same CSR works for either type; the type is selected in Apple Developer, not in this tool.

Is the private key stored on the server?

No. In step 1, the CSR and private key are generated on demand by a stateless Capgo endpoint over HTTPS and returned straight to your browser with Cache-Control: no-store; they are never written to a database or kept after the response. Step 2, the .cer to .p12 converter, runs entirely in your browser and uploads nothing. If your policy requires local key generation, use the equivalent OpenSSL command on this page.

Why do I need to convert the .cer file to .p12?

The .cer file Apple gives you only contains the public certificate. Signing an app also requires the private key, so build tools expect a .p12 file that bundles the certificate and private key behind a password.

How do I convert a .cer to .p12?

Use step 2 on this page: select the .cer from Apple (DER or PEM), select the private key .pem used to create the CSR, enter a password, and select Build .p12 file. The browser checks that the certificate matches the key and builds a 3DES-encrypted .p12 that macOS Keychain, Xcode, and fastlane accept. Nothing is uploaded. You can also copy the .p12 as base64 for CI secrets.

Do I need an Apple Developer account?

Yes. Uploading a CSR and issuing signing certificates requires a paid Apple Developer Program membership (99 USD per year, or the Enterprise program for in-house distribution). The CSR itself can be generated without an account.

How long is an iOS signing certificate valid?

Apple Development and Apple Distribution certificates are valid for one year. Apps already live on the App Store keep working after the certificate expires or is revoked, but you need a new certificate and provisioning profile to sign the next build.

Can I reuse the same CSR or private key?

You can, but a fresh key pair per certificate is safer and easier to rotate. What you must not do is mix them: a .cer only works with the exact private key that created its CSR. If the key is lost, revoke the certificate and generate a new CSR.

Can I use this CSR for push notification (APNs) certificates?

Yes. Apple asks for a CSR when you create an APNs SSL certificate too. For new apps, an APNs authentication key (.p8) is usually simpler because it never expires and works for all your apps.

Keep going

iOS signing and release guides

Tool stack

More mobile delivery tools

Use these generators and device utilities together to keep signing, testing, and distribution moving without leaving the browser.

Profile service

iOS UDID Finder

Find an iPhone or iPad UDID in seconds from Safari, without a Mac or iTunes, plus model, serial, and iOS version.

Open tool

PKCS#12 keystore

Android Keystore Generator

Generate an Android keystore online without Android Studio: a PKCS#12 release key with SHA-1 and SHA-256 fingerprints for Google Play.

Open tool