Why do I get error "provide a properly configured and signed bearer token" when creating cert after upgrade to VS 17.12

Kurt K 176

I recently upgraded to Visual Studio 2022 17.12. At about the same time, my ios development cert expired.

So I needed to create a new development certificate.

First I tried to create a one using the "Create Certificate" dropdown by:

Choosing the Tools -> Options menu item
Navigating to Xamarin -> Apple Accounts
Chose my existing Apple account
Clicked "View Details..."

I got the "... provide a properly configured and signed bearer token ..." error.

Then I tried to create a new cert consulting the video by Gerald Versluis: https://www.youtube.com/watch?v=kpZi5xAvpZA

It seemed to work since a new cert shows up as active on my Mac and in my Apple developer account.

I then edited my existing dev provisioning profile to replace the old cert with the new one.

However, I could not get the new cert and provisioning profile to show up in Visual Studio.

Finally, I decided to create a new .net maui project to see if I could then see the new cert and provisioning profile in visual studio - I could not.

Also, still in this new project the "Create Certificate" dropdown still generates the same error.

Can you give me hints on how to proceed?

Thank you

Kurt K 176 Reputation points

2024-12-04T21:07:27.09+00:00

Some more details:

The new dev provisioning profile does show up in project properties under iOS -> Bundle Signing, but the new dev certificate does not show up in the "Signing identity" dropdown.

That is confusing since the new dev cert was set in the provisioning profile, seemingly successfully. Also, right clicking on the new cert in "Keychain Access" on the Mac and choosing "Evaluate" yielded Evaluation Status: Success, and "Certificate Status: Good.

I have an existing Apple app store cert and distribution provisioning profile. Those both show up under iOS -> Bundle Signing just fine.

It seems this all point to a problem with the new development cert, but I am not sure why.
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-05T06:39:35.1366667+00:00

Is your Apple developer account an individual account? Please check if you have followed the steps to create an API key: Go to App Store Connect, click User and Access, go to Integrations tab, choose App Store Connect API, then generate an API Key under Team Keys.

After that you could download the p8 file. And then open VS 2022 and go to Tools-> Options-> Xamarin-> Apple Accounts -> Add-> Individual account, entered the recently (active) generated API key details (attached the recently saved p8 file).

Finally, you could click ViewDetails to see if you still have the problem and check if you can see the provisioning profile.
Kurt K 176 Reputation points

2024-12-05T22:28:50.7933333+00:00

The existing Apple developer account I have always been using is an Individual account. (I saw this under "Membership Details".)

Also, the existing App Store Connect API key that I have is a Team Key (the Team Keys tab). There are no "Individual Keys" shown.

I have been using the Apple developer account and the App Store Connect API Key for at least a year successfully.

During that time, I successfully was using a developer cert and wildcard development profile to test the app on my iPhone and iPad. This cert and profile were created by VS using Automatic Provisioning. I did not mention this earlier, but now when I try to use Automatic Provisioning and click "Configure Automatic Provisioning", I immediately get that same "... provide a properly configured and signed bearer token ..." error. That is why I tried to manually create a new cert on the Mac.

The problems started happening after I tried a development build after upgrading to Visual Studio 2022 v17.12.2. It had been a while since I did the last build.

After the last build and before I tried one after upgrading VS, my development cert expired on 11/28/2024. Hence the need for a new cert.

One thing I did just notice was that the "User ID" values associated with my expired dev cert and the cert I just created are different. Maybe that is because the expired one was created using Automatic Provisioning?

I also realized that I chose to manually create an "iOS Development" cert rather than "Apple Development" for the one created via Automatic Provisioning. May that have something to do with it?

Thank you.
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-09T01:11:32.2033333+00:00

One thing I did just notice was that the "User ID" values associated with my expired dev cert and the cert I just created are different. I also realized that I chose to manually create an "iOS Development" cert rather than "Apple Development" for the one created via Automatic Provisioning. May that have something to do with it?

Yes, you could choose the provisioning profile with the new certificate manually. After choosing the new provisioning profile, are there any other errors? You could also create a development provisioning profile at Apple developer portal manually and then download the provisioning profile and choose it.
Kurt K 176 Reputation points

2024-12-09T18:56:14.6933333+00:00
Thanks for the comment.

Two follow-up questions:

Sorry, I do not know what you mean by "you could choose the provisioning profile with the new certificate manually." Choose it where? It does not show up anywhere in Visual Studio.

Why would Visual Studio immediately come back with that "... provide a properly configured and signed bearer token ..." error when I click the "Configure Automatic Provisioning" button?

Thank you.
Kurt K 176 Reputation points

2024-12-09T19:02:19.78+00:00

I just submitted a comment to your 12/8 comment. Please disregard question 1. of that comment. The profile DOES appear in Visual Studio, but the corresponding certificate does not. I need to look at that again. Still, an answer to my question 2. in that comment would help me.

Thank you.
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-10T03:40:21.41+00:00

OK, you mean you found the root cause is missing the corresponding certificate, right? You could go to Apple developer portal and edit the provisioning profile to include all certificates, and then download the provisioning profile with VS. After that you could choose that provisioning profile for your project.

Why would Visual Studio immediately come back with that "... provide a properly configured and signed bearer token ..." error when I click the "Configure Automatic Provisioning" button?

This error means the API key was expired or revoked and VS cannot communicate with Apple developer connect, or you have created one certificate automatically and you cannot create a new one automatically. Please check if you can create a development provisioning profile at Apple developer portal manually and choose this provisioning profile manually for your project.
Kurt K 176 Reputation points

2024-12-10T04:25:15.36+00:00

Answer to your first question: No, I did not find the "root cause is missing the corresponding certificate". The certificate appears valid on the Mac and in the Apple developer portal, but it does not show up in VS.

I am going to blow away all existing development certs and profiles, and start from scratch to manually create them per the document link you provided. Then I will report whether that fixed the problem.

Thank you.
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-10T05:45:46.9566667+00:00

Thanks for your feedback, wait for your updates.
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-12T01:28:16.5933333+00:00

May I know whether your issue has been solved or not? If you're still having problems, please explain in detail what is still going wrong and what you need help with.
Kurt K 176 Reputation points

2024-12-12T17:32:40.4533333+00:00

Sorry, I have been working on something else. I will try to get it working and will get back to you by the middle of next week.
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-13T01:42:45.3666667+00:00

OK, wait for your updates.
Kurt K 176 Reputation points

2024-12-17T22:50:15.9033333+00:00

I started work on this again, today.

First, I did the following, in order to start from scratch:

Revoked the current development cert from Apple account. (got email saying that happened)

Deleted the associated development profile from Apple account.

Deleted all expired development certs from "Keychain Access" on Mac.

Deleted wildcard development App ID from "Identifiers" section of "Cert's, Ident's & Profiles" section of Apple account.

Then I ran into an anomaly:

I ran Visual Studio and connected to the Mac. After I did that, I notice that the most recent expired development cert that I had (see above - expired 11/28/2024) re-appeared in Keychain Access on the Mac.

So it appears that Visual Studio is hanging onto at least 1 old development cert. I searched on how to purge expired certs from Visual Studio and found this link: How Do I remove all Apple iOs Account info, Certificates ...

It suggests to remove the Apple account from Visual Studio and then add it back. I would rather not do that since I have a valid distribution cert and profile that I do not want to lose.

The article said I could also choose to delete individual certs/profiles under ...\AppData\Local\Xamarin\iOS\Provisioning. Based on file dates, there are 2 certs under "Certificates": the expired development cert and the valid distribution cert. It looks there are 2 files associated with each cert: a *.p12 file and a *.pass file. So is it OK to delete the p12 and pass files associated with the expired dev cert? Or is there another recommended way to do that?

Also, I noticed that there are many *.mobileprovision files under ...\AppData\Local\Xamarin\iOS\Provisioning\Profiles. It would be hard to determine which file(s) to delete. However, maybe only certificate files are an issue for me, so for now I will ignore those.

Thank you.
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-18T05:33:44.8933333+00:00

Deleted all expired development certs from "Keychain Access" on Mac. You kept the valid certificates, right?
It looks there are 2 files associated with each cert: a *.p12 file and a *.pass file.

Is this file same as your valid certificate in "Keychain Access" on Mac?

It suggests to remove the Apple account from Visual Studio and then add it back. I would rather not do that since I have a valid distribution cert and profile that I do not want to lose. Removing the Apple account from Visual Studio won't remove your distribution cert and profile. (Because we didn't find the root cause, it's prudent and understandable that you don't remove the Apple account)

Go back to the error on the origin content - you got the "... provide a properly configured and signed bearer token ..." error.

It suggests removing the Apple account (via API) and login the account with another API key.

The biggest advantage to login Apple developer account is to view and manage your certificates and provisioning profiles. See Apple account management - .NET MAUI | Microsoft Learn

It looks there are 2 files associated with each cert: a *.p12 file and a *.pass file. So is it OK to delete the p12 and pass files associated with the expired dev cert?

This p12 file is the certificate, *.pass file is the password. If you have confirmed that they are expired, you can remove them.

Accepted answer

Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-18T06:15:29.1466667+00:00
Hello,

Since there are some valid certificates in "Keychain Access" on Mac and you can open the ...\AppData\Local\Xamarin\iOS\Provisioning(certificates) folders, there is an easy way to import certificate and provisioning profile into VS, please follow the steps blow:

Open "Keychain Access“, find a valid development certificate, right-click it and choose "Export...", and then you can enter a password, and you will get a p12 file.

Move/Copy this p12 file to your Windows machine.

Open VS 2022 and go to Tools-> Options-> Xamarin-> Apple Accounts->select the account you login -> View Details->Import Certificate, select the p12 file on step2 and enter the password on step1.

After that, the certificate will exist on the \AppData\Local\Xamarin\iOS\Certificates folders.

If you have the matching provisioning profile (*.mobileprovision files), you could move it to \AppData\Local\Xamarin\iOS\provisioning folder.

And then, you could select the Signing identity (certificate) and provisioning profile for your project.

(Open your project->right-click and open Properties window->iOS->Bundle Signing)

Important

According to the description, you have revoked the current development cert from Apple account and delete the associated development profile from Apple account. It's not clear that if the valid certificate on "Keychain Access" is matched with the previous development provisioning profile (Or if the development provisioning profile was expired or you deleted/revoked it by mistake) .

It's better to create a new development provisioning profile with the valid development certificate on Keychain Access. Please follow the steps below:

Open Apple developer portal, under Certificates tab, confirm the valid development certificate is same as that on Keychain Access.

Go to Profiles tab, choose iOS App Development -> choose the AppID (your MAUI project AppID or the wildcard AppID) ->select all certificates -> all devices->enter name->Generate->Download, and then you will get a development provisioning profile (*.mobileprovision files).

Move it to \AppData\Local\Xamarin\iOS\provisioning folder.

For more details, you could refer to Manual provisioning for .NET MAUI iOS apps - .NET MAUI | Microsoft Learn

Best Regards,

Wenyan Zhang

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
Kurt K 176 Reputation points

2024-12-18T23:28:08.24+00:00

Thank you for all your help!

I deleted the .p12 and .pass files in the ...AppData\Local\Xamarin\iOS\Provisioning\Certificates folder that I identified as the expired cert.

Then the expired cert no longer appeared in Keychain Access on the Mac. when connection to the Mac from VS.

I had already revoked/deleted the existing dev cert and provisioning profile that I said I was going to delete in one of my Dec 9 comments.

I also deleted the existing wildcard development app id.

Then I created a new dev cert, wildcard dev app id, and provisioning profile.

Finally per your instructions, I imported the dev cert and provisioning profile into Visual Studio.

Now the new dev cert and provisioning profile properly show up in project properties under iOS -> Bundle Signing! Also, I was able to build a dev version for my iPhone, and deployed to the phone.

So all looks good again.

Thanks again for your help!

Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 34,556 Reputation points Microsoft Vendor

2024-12-19T05:57:25.0966667+00:00

Glad you solved the problem. Congratulations!

Kurt K 176 Reputation points

2024-12-19T18:14:10.96+00:00

Thank you, but I could not have done it without you!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Why do I get error "provide a properly configured and signed bearer token" when creating cert after upgrade to VS 17.12

0 additional answers

Your answer