IOS – cannot sign iOS app in XCode – in a catch 22

certificateioskeychainxcode

I have built then Archived my iOS app now need to submit to Validate and push to app store

xcode says this on main page when checkmark off Automatic signing … so do manual sign

then picked provisioning profile : prototype prod ( my app )

Status :

No signing certificate "iOS Distribution" found
No "iOS Distribution" signing certificate matching team ID "X8B4734GCE" with a private key was found.

yet when I click on Manage Certificates …
window says

iOS Distribution Certificates
iOS Distribution    john stensland      good date    Missing Private Key

then when I click on + sign and select

iOS Distribution

popup message says

You already have a current iOS Distribution certificate or a pending certificate request

then on page https://developer.apple.com/account/resources/certificates/add

iOS Distribution (App Store and Ad Hoc)
Sign your iOS app for submission to the App Store or for Ad Hoc distribution.
Maximum number of certificates generated

How do I dig myself out of this hole ?

xcode 10.3

osx 10.14.6

this is interesting

stens@chambord:~/src/github.com/foo/bar/.meteor/local/cordova-build/platforms/ios$ xcodebuild -showBuildSettings
Build settings for action build and target BamPow:
2020-02-21 16:59:25.836 xcodebuild[6533:99111]  DVTAssertions: Warning in /Library/Caches/com.apple.xbs/Sources/IDEFrameworks/IDEFrameworks-14492.2/IDEFoundation/Provisioning/IDEProfileQualification.m:509
Details:  Xcode could not determine type of profile "/Users/stens/Library/MobileDevice/Provisioning Profiles/4ba9f335-1ffa-4ad8-9c92-72fd580ced9d.mobileprovision" (could be {(
)})
Object:   <IDEProfileQualification: 0x7fbc7611f210>
Method:   -_profileTypeQualifier
Thread:   <NSThread: 0x7fbc7378f950>{number = 8, name = (null)}
Please file a bug at https://bugreport.apple.com with this warning message and any useful information you can provide.
2020-02-21 16:59:25.837 xcodebuild[6533:99111]  DVTAssertions: Warning in /Library/Caches/com.apple.xbs/Sources/IDEFrameworks/IDEFrameworks-14492.2/IDEFoundation/Provisioning/IDEProfileQualification.m:509
Details:  Xcode could not determine type of profile "/Users/stens/Library/MobileDevice/Provisioning Profiles/f87b46f0-e0e3-4c65-9497-d80eaed5bdcd.mobileprovision" (could be {(
)})
Object:   <IDEProfileQualification: 0x7fbc761c8d60>
Method:   -_profileTypeQualifier
Thread:   <NSThread: 0x7fbc7378f950>{number = 8, name = (null)}
Please file a bug at https://bugreport.apple.com with this warning message and any useful information you can provide.
2020-02-21 16:59:26.049 xcodebuild[6533:99080]  iPhoneConnect: ?<DVTiOSDevice (0x7fbc76361910), bauernkrieg, iPhone, 13.3.1 (17D50), 1c93668b892495ee9a62dc879152529241305427> unable to mount developer disk image, (Error Domain=com.apple.dtdevicekit Code=601 "Could not locate device support files." UserInfo={DeviceType=iPhone8,1, NSLocalizedDescription=Could not locate device support files., NSLocalizedRecoverySuggestion=This iPhone 6s is running iOS 13.3.1 (17D50), which may not be supported by this version of Xcode.}) {
    DeviceType = "iPhone8,1";
    NSLocalizedDescription = "Could not locate device support files.";
    NSLocalizedRecoverySuggestion = "This iPhone 6s is running iOS 13.3.1 (17D50), which may not be supported by this version of Xcode.";
}
2020-02-21 16:59:26.375 xcodebuild[6533:99111]  DVTAssertions: Warning in /Library/Caches/com.apple.xbs/Sources/IDEFrameworks/IDEFrameworks-14492.2/IDEFoundation/Provisioning/IDEProfileQualification.m:509
Details:  Xcode could not determine type of profile "/Users/stens/Library/MobileDevice/Provisioning Profiles/4ba9f335-1ffa-4ad8-9c92-72fd580ced9d.mobileprovision" (could be {(
)})
Object:   <IDEProfileQualification: 0x7fbc760f30b0>
Method:   -_profileTypeQualifier
Thread:   <NSThread: 0x7fbc7378f950>{number = 8, name = (null)}
Please file a bug at https://bugreport.apple.com with this warning message and any useful information you can provide.
2020-02-21 16:59:26.375 xcodebuild[6533:99111]  DVTAssertions: Warning in /Library/Caches/com.apple.xbs/Sources/IDEFrameworks/IDEFrameworks-14492.2/IDEFoundation/Provisioning/IDEProfileQualification.m:509
Details:  Xcode could not determine type of profile "/Users/stens/Library/MobileDevice/Provisioning Profiles/f87b46f0-e0e3-4c65-9497-d80eaed5bdcd.mobileprovision" (could be {(
)})
Object:   <IDEProfileQualification: 0x7fbc76536280>
Method:   -_profileTypeQualifier
Thread:   <NSThread: 0x7fbc7378f950>{number = 8, name = (null)}
Please file a bug at https://bugreport.apple.com with this warning message and any useful information you can provide.
    ACTION = build
    AD_HOC_CODE_SIGNING_ALLOWED = NO
    ALTERNATE_GROUP = staff
    ALTERNATE_MODE = u+w,go-w,a+rX
    ALTERNATE_OWNER = stens
    ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = NO
    ALWAYS_SEARCH_USER_PATHS = NO

So over on developer.apple.com to Revoke an iOS Distribution certificate so I can recreate one fresh it shows me

Do you want to revoke the certificate?

Revoking this certificate will invalidate it and any related services or > provisioning profiles that use this certificate may be affected.

Is that a dangerous proposition ? I have loads of goodies in production humming away … its not clear what is implied when it says

will invalidate it and any related services

So should I Revoke this iOS Distribution Certificate and recreate one fresh ? Is this the escape hatch ?

Update yes just Revoke then create a new certificate -> download -> double click -> it gets uploaded into keychaing/xcode then it appeared in xcode -> Preferences -> Accounts -> choose Apple ID -> Team -> Manage Certificates … then xcode Automatic signing worked … moral is ignore the browser warning when revoking an iOS Distribution Certificate

Best Answer

You seem to think that there's a contradiction between the two message you receive, but actually they're saying the same thing.

You lack the private key for your iOS Distribution certificate on your computer. You cannot use the iOS Distribution certificate for signing anything without the private key.

You (or someone else on your team) have generated that private key at some point. If you have the private key on a different computer, in a backup, or can get it from someone else, you'll just need to export the key from that other computer and import it on this computer. Then you can proceed with automatic signing or manual signing like you have already done.

If you cannot recover the private key, you'll run into the message that you have seen saying that you cannot generate yet another iOS Distribution certificate as you have already reached your limit. You can overcome that by revoking your existing certificate(s). You do that on the developer web site in "Certificate, Identifiers & Profiles". Click "Certificate" in the menu on the left, click on your certificate and then click the red "Revoke" button.

After revoking your certificate, you can proceed with automatic signing and generate a new certificate.