iOS "Unknown Error = -2,147,409,850" while trying to generate Certificate Signing Request (CSR)

[bcspragu]

I'm packaging a PWA as an iOS app using PWABuilder, and I'm hitting a wall on step 3, where I'm supposed to use Keychain Access/Certificate Assistant to generate a CSR, but it keeps failing with the error mentioned in the title. If it makes a difference, I don't have any physical Mac hardware, so I'm using an AWS Mac instance and have logged into that with my Apple Developer account.

I could only find one other mention of this specific error code on the entire internet, which definitely, definitely does not bode well for me. Any help is much appreciated!

I've tried a few workarounds I saw for other, similar Keychain Access errors on the internet, e.g. selecting "Let me specify key pair information", but the error remains the same, screenshot below:

[jgw96]

@khmyznikov any ideas on this one?

[bcspragu]

For what it's worth, I fixed this by just using someone's physical MacBook to generate the keys, not sure if the issue is specific to AWS Macs or not.

[larry-oj]

Greetings everyone, found a solution (that worked for me)
Encountered the same error code, I am also using AWS Mac Instance.

Instead of using Keychain Access/Certificate Assistant, I used openssl in the terminal to generate a CSR, and it was accepted by Apple!
The command I used was openssl req -new -newkey rsa:2048 -nodes -keyout mykey.key -out myrequest.csr

Although my usecase for CSR is unrelated to PWABuilder, this is the only place in the internet with this particular error code in Keychain Access/Certificate Assistant, so I might as well leave my solution here

[fthomas-team]

Larry you are a life-saver. Worked for me as described once I massaged the command to point at paths my ec2-user could actually edit and had to fix my openssl.cnf file for some reason because it was missing (https://serverfault.com/questions/1098257/cant-open-usr-lib-ssl-openssl-cnf)

Working command for me:
openssl req -config /System/Library/OpenSSL/openssl.cnf -new -newkey rsa:2048 -nodes -keyout /Users/ec2-user/Downloads/mykey.key -out /Users/ec2-user/Downloads/myrequest.csr