Why am I getting "Cannot create resource without certificate private key" during iOS automatic code signing?

Last updated: July 9, 2026

Context

When using automatic code signing in Codemagic, you may encounter the following error during the build process:

Cannot create resource without certificate private key
Cannot save Signing Certificates without certificate private key

This error occurs because automatic code signing requires a certificate private key to create the necessary certificate and provisioning profile.

Answer

To resolve this issue, you need to provide a 2048-bit RSA private key as an environment variable called CERTIFICATE_PRIVATE_KEY. You have two ways to obtain this key: create a brand-new key, or reuse the key from a Distribution certificate you already have.

Option 1: Create a new key

Use this if you don't already have an iOS Distribution certificate, or you're comfortable letting Codemagic create one for you.

  1. Open a terminal on your computer and run the following command to generate a new RSA private key:

ssh-keygen -t rsa -b 2048 -m PEM -f ~/Desktop/ios_distribution_private_key -q -N ""

This creates a file named ios_distribution_private_key on your Desktop. Codemagic will use this key to create a new iOS Distribution certificate in your Apple Developer account if one matching this key doesn't already exist.

Option 2: Use an existing key

Use this if you already have an iOS Distribution certificate and want to reuse it — for example, to avoid creating additional certificates (see the note below).

  1. On the Mac that created the iOS Distribution certificate, open Keychain Access (in the Applications → Utilities folder).

  2. Select the certificate entry, listed as iPhone Distribution: company_name (team_id).

  3. Right-click it and choose Export.

  4. In the export prompt, set the file format to Personal Information Exchange (.p12).

  5. Give the file a name such as IOS_DISTRIBUTION, choose a location, and click Save.

  6. When prompted for a password, leave it empty and click OK.

  7. Export the private key with the following command:

openssl pkcs12 -in IOS_DISTRIBUTION.p12 -nodes -nocerts | openssl rsa -out ios_distribution_private_key

  1. When prompted for the import password, press enter. The key is written to a file named ios_distribution_private_key in the directory where you ran the command.

Add the key to Codemagic

Whichever option you used:

  1. Open the generated ios_distribution_private_key file with a text editor.

  2. Copy the entire contents of the file, including the header and footer tags:

-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

  1. In your Codemagic environment variables, create a new variable named CERTIFICATE_PRIVATE_KEY and paste the copied key as its value.

  2. Re-run your build.

Note: You only need one private key. Reuse the same key across all of your apps rather than generating a new one for each. When automatic code signing runs with the --create flag, Codemagic will create a new Distribution certificate if it can't find an existing one matching your CERTIFICATE_PRIVATE_KEY. Apple limits the number of active Distribution certificates per account — 3 for a standard Apple Developer Program account and 2 for an Apple Developer Enterprise Program account. If each app uses its own key, these new certificates add up and you can exhaust the limit, at which point builds fail with You already have a current Distribution certificate or a pending certificate request.

Recommended setup for multiple apps

To avoid hitting the certificate limit, store your CERTIFICATE_PRIVATE_KEY once as a shared secret under Settings → Team → Codemagic.yaml settings → Global variables and secrets, then reference it in each app's configuration. This ensures all your apps reuse the same certificate rather than each attempting to create a new one.

For more details on both methods, refer to the Codemagic documentation on alternative code signing methods.