Intermittent SSL issue trying to load iOS certificates

[OliverBrown-Next]

Description

We have recently started getting SSL errors when trying to install iOS certificates. Our workflow related to this has not changed for a long time. It does work sometimes (with the same certificates) so I don't believe there are any problems with the certificates.

This happens on macOS 15 20241106.316 but we only very recently switched to macOS 15 and it happened on macOS 14 too.

Starting: Install Dist Apple certificate
==============================================================================
Task         : Install Apple certificate
Description  : Install an Apple certificate required to build on a macOS agent machine
Version      : 2.246.5
Author       : Microsoft Corporation
Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/install-apple-certificate
==============================================================================
/usr/local/bin/openssl pkcs12 -in /Users/runner/work/_temp/EnterpriseDistribution.p12 -nokeys -passin pass:*** | /usr/local/bin/openssl x509 -sha1 -noout -fingerprint -subject -dates -nameopt utf8,sep_semi_plus_space
Error outputting keys and certificates
40CBBC50F87F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:355:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()
Could not find certificate from <stdin>
##[warning]Error parsing certificate. This might be caused by an unsupported algorithm. If you're using old certificate with a new OpenSSL version try to set -legacy flag in opensslPkcsArgs input.
##[error]Error: /usr/local/bin/openssl failed with return code: 1
Finishing: Install Dist Apple certificate

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• Ubuntu 24.04
• macOS 12
• macOS 13
• macOS 13 Arm64
• macOS 14
• macOS 14 Arm64
• macOS 15
• macOS 15 Arm64
• Windows Server 2019
• Windows Server 2022

Image version and build link

Image: macos-15
Version: 20241106.316

Is it regression?

Yes

Expected behavior

Certificate install correctly.

Actual behavior

Certificates not installed.

Repro steps

Attempt to install iOS certificates. I don't know if it something specific to the certificates I'm using though.

[OliverBrown-Next]

I've just discovered this issue, which seems to be the problem and may be a better place:

microsoft/azure-pipelines-tasks#20628

[OliverBrown-Next]

Based on the discussion (and looking at recent runs) I suspect this was intermittent on macOS 14 as the updated agent was rolling out, but is every time on macOS 15.

[susmitamane]

@OliverBrown-Next We will look into the issue and keep you posted with updates.

[thisisthekap]

Seems like macos-15 20241106.316 requires us to add opensslPkcsArgs: -legacy to the InstallAppleCertificate@2 task. But for older image versions (e.g. macos-15 20241022.244) we must not add this line (otherwise the build fails because the legacy argument seems to be unsupported for that case).

The issue that we are currently facing: macOS-15 20241106.316 does not seem to be rolled out to all hosted agents as of now.

[thedee]

I get this same error when doing:
vmImage: 'macos-15'
sudo xcode-select -s /Applications/Xcode_16.app/Contents/Developer