Apple code signing uses an asymmetric key pair: a public key inside a certificate that Apple has signed, and a private key that only you have. The private key is what actually signs a build. The certificate just lets a verifier (Xcode, codesign, the App Store, Gatekeeper) check that the signature came from the holder of the matching private key.
Where private keys live
- On the Mac of whichever developer generated the original CSR. The key was created locally and never left that machine.
- Exported into a .p12 file (PKCS#12) so a teammate or build server can import it.
- Stored in a secret manager (1Password, AWS Secrets Manager, HashiCorp Vault) and pulled into CI at build time.
- Held by a managed signing service like HexSign or fastlane match, encrypted at rest and decrypted only inside the signing process.
Common failure modes
- The developer who generated the CSR leaves the company and nobody else has the private key. The certificate still works, but you cannot rotate it.
- A .p12 with a weak password ends up in a public git repo. Anyone who finds it can sign builds as your team.
- Two developers each generate their own private key for the same certificate type, so the team ends up with two distribution certificates and neither one matches the other's provisioning profile.