Cannot sign app in Xcode CSSMERR_TP_NOT_TRUSTED

I have downloaded and installed the WWDR certificate. I have tried setting it to Always Trust and system defaults.

When I try to archive my app I get the CSSMERR_TP_NOT_TRUSTED error.

If I try signing manually I get the same:

/usr/bin/codesign --force --sign "3rd Party Mac De开发者_运维技巧veloper Application: XX XXX-XXX" /Users/XXX/Library/Developer/Xcode/DerivedData/XXX-fivqootinaolitdbpxccqykoaoqs/ArchiveIntermediates/XXX/InstallationBuildProductsLocation/Users/XXX/Applications/XXX.app

/Users/xxx/Library/Developer/Xcode/DerivedData/xxx-fivqootinaolitdbpxccqykoaoqs/ArchiveIntermediates/xxx/InstallationBuildProductsLocation/Users/xxx/Applications/xxx.app: replacing invalid existing signature /Users/xxx/Library/Developer/Xcode/DerivedData/xxx-fivqootinaolitdbpxccqykoaoqs/ArchiveIntermediates/xxx/InstallationBuildProductsLocation/Users/xxx/Applications/xxx.app: CSSMERR_TP_NOT_TRUSTED

BUT

If I use

sudo /usr/bin/codesign --force --sign

Then it works....

The key is installed in keychain access in the 'login' chain.

---

Obishawn used one of the suggestions provided by Apple in the following steps published to troubleshoot this error - How do I resolve the CodeSign error: CSSMERR_TP_NOT_TRUSTED? . For others experiencing this build error -

CSSMERR_TP_NOT_TRUSTED

the above guide covers a more broad range of potential causes. The error can also occur at Xcode Archive > Share, Validate, or Submit time, and the above steps to resolve it are the same.

---

Ok, I finally figured mine out. I had the WWDR certificate in my login keychain and my System keychain. I deleted both and reimported a fresh one from Apple and everything works now. I can codesign without using sudo and MonoDevelop can fully compile for distribution and upload to my devices.

---

My two cents on that problem : I had to fight with it for some hours. Here are what I had to fix to have codesign do its job :

• Ensure that certificates are not duplicated between the login and the system keychain
• Ensure no old / expired / revoked versions of the certificates exist in any keychain
• Ensure all certificates have "system default" trust policy. If one is set to "always trust", then codesign will fail.

This last point was found on a machine that was migrated to Xcode 8.2 recently. It might be a new behavior of Xcode 8.