Hello,

I stumbled upon this discussion as I was trying to use match import. After struggling with the import for quite some time, I found out that the key file must be an unencrypted file. At least on MacOS, an encrypted PKCS file cannot be imported with an empty password.

As match encrypts the key file anyway, using an encrypted file with an additional password is not important to me.

However, it took me quite some time to find out how it works (reading the code and analyzing an existing match repository). It would be nice if the documentation (website and command options) of match import would be improved:

• Certificate must be DER encoded (as far as I know).
• Key must be PKCS in PEM (unencrypted).

It would be even nicer if the import command would verify the supplied files before adding them to the repository.

Another limitation is, that it will only work if the certificate and key file have the same name (if I didn't miss something in the code).

As I struggled for a long time today to do this (knowing I successfully did this before):

To move an existing Enterprise Certificate/Key Pair from the Keychain Access App to match do the following:


1. Open Keychain Access
2. Go into the certificates tab
3. Filter for the certificate you want to export
4. Klick the small “>” next to the certificate to reveal the key
5. Right Klick on the key, choose export
6. Choose the “P12” Format, klick “OK”
7. Do not set a password, just klick “OK”
8. Right Click on the certificate, choose export
9. Choose the “CER” Format, klick “OK”
10. Copy the Certificates.cer and Certificates.p12 files into your project folder
11. Run

bundle exec fastlane match import --readonly true --type enterprise --skip_certificate_matching true

When asked for the .cer file, write Certificates.cer
When asked for the .p12 file, write Certificates.p12

When asked for the mobileprovisioning files, just hit enter.



To import a profile, run e.g.

openssl aes-256-cbc -k <MATCH_PASSWORD> -in unencrypted.mobileprovision -out encrypted.mobileprovision -a

and upload the result to the "profiles/enterprise" folder of your match repo.

Would love to have a way to provide a password during match import or to have more docs on how to remove a password from a certificate. It's pretty confusing on how to properly do that.

One confusing part is that my p12 file contains both Certificate and Private Key. So I'm not sure if I need a separate Cert.cer file. I'm also unsure if new p12 file should contain only Private Key or if I should include Certificate as well.

Then @maklostermann mentioned that it should be non-encrypted pem file instead of p12 for the private key.

So much confusion and unsure where to find my answer 😕