In this article, we describe the actions neccessary to generate a self-signed Code Signing certificate under Apple OS X 10.6 (Snow Leopard); this certificate can then be used for testing purposes, and can later be certified by a certificate authority once the code is deemed mature enough for public distribution. Links to these procedures can be found at the bottom of this article.
The best way to generate a private key and CSR for code signing is by use of Keychain Access, the OSX program specially designed to manage certificates and passwords. Note that this is somewhat different from most scenario's, where the certificate generation is managed through the browser. Also, we have experienced occasional problems when using Safari to request a Code Signing Certificate. To ensure successful import we advise you to adhere to using Keychain Access.
In Keychain Access, go to the Keychain Access menu and navigate to Certificate Assistant, then click Create a Certificate Authority… . This opens the Certificate Assistant in a new window.
Serial Number: choose any number you like, only make sure it's unique and lies between 1 and 2147483647.
Validity Period: leave it at 365. This will automatically be altered to fit the actual duration later.
Remove the checkmarks next to Create a CA web site: and Sign your invitation.
Next, press Continue 12 times (you may leave the default settings in all the subsequent screens).
If all has gone well, you will now be able to find your self-signed certificate pair listed under login / All Items in Keychain Access with the name you entered in the Name (Common Name) field in step 5. There should be three entries: the private key, the public key and the certificate (visible under the Kind column). (Note that the certificate will have a small red X through it, indicating "this root certificate is not trusted"; this is correct as it has not yet been signed by a Certificate Authority). That process is described in the links below.