using security to importing CSSMERR_TP_CERT_EXPIRED secutity codesigning - macos

Question

Does anybody know why when I use 'security' on os x to import a valid identity that it seems to think it has expired:
There are 2 machines, my development machine and a jenkins slave.
I am using the xcodebuild to create an archive and then use:
xcodebuild -exportArchive -archivePath myApp.xcarchive -exportOptionsPlist exportOptions.plist -exportPath . PROVISIONING_PROFILE=fdd0caeb-58fb-41df-a5e8-e5e9bd1f95c9 "OTHER_CODE_SIGN_FLAGS=--keychain /Users/me/Library/Keychains/Buildsystem"
to build an ipa for the store. This works on my development machine using the same archive and the same exportOptions.plist but not on the jenkins slave. I get this error:
016-10-06 23:29:23.438 xcodebuild[87720:8494157] [MT] IDEDistribution:
-[IDEDistributionLogging _createLoggingBundleAtPath:]: Created bundle at path
'/var/folders/yd/l_8k4cn91kjc9r853crzz98m0000gn/T/MyApp_2016-10-06_23-29-23.437.xcdistributionlogs'.
2016-10-06 23:29:23.888 xcodebuild[87720:8494157] [MT]
IDEDistribution: Step failed: : Error Domain=IDEDistributionErrorDomain Code=1 "The
operation couldn’t be completed. (IDEDistributionErrorDomain error
1.)"
error: exportArchive: The operation couldn’t be completed.
(IDEDistributionErrorDomain error 1.)
Error Domain=IDEDistributionErrorDomain Code=1 "The operation couldn’t
be completed. (IDEDistributionErrorDomain error 1.)"
** EXPORT FAILED **
I suspect it is because it thinks the code signing identity is bad. When I imported the identity as:
security import AP_Store.p12 -k /Users/me/Library/Keychains/Buildsystem -P ******* -T /usr/bin/codesign
then run:
security find-identity
I get:
1) 71497439A2987BC6830DF2E4879DBD3A5F1B2857 "iPhone Distribution:
xxxxx (xxxxxxxxx)" (CSSMERR_TP_CERT_EXPIRED)
If I import the same identity on my development machine it says it is OK.
Does anybody know why the same identity would be OK on one machine but not another?

Answer 1

This was caused by an expired intermediate certificate.
Apple Worldwide Developer Relations Certification Authority
had expired.
After replacing it everything worked.
A good reference is: MaintainingCertificates
Another thing that can lead to errors such as:
2016-10-11 11:41:11.780 xcodebuild[87463:15799133] [MT]
IDEDistribution: Step failed: : Error Domain=IDEDistributionErrorDomain Code=1
"(null)"
error: exportArchive: The operation couldn’t be completed.
(IDEDistributionErrorDomain error 1.)
is if you have an incorrect team ID in your exportOptions.plist file.