WalletPassAPI
Request access

Pass certificate tool

Check an Apple Wallet Pass Type ID certificate, make the certificate signing request Apple asks for, and turn Apple's .cer into a .p12.

Your certificate, key and password stay in your browser

Save a copy

With a new password, encrypted with AES, or with the older 3DES for tools that can't open AES.

A certificate signing request

Upload it to Apple when you create a Pass Type ID Certificate. Your browser makes a new 2048-bit RSA key to go with it.

Your request and its key appear here.

Save the private key now and keep it safe. Apple's certificate only works with it, and it isn't kept anywhere else: if you lose it, you'll need a new request and certificate.

  1. In your Apple Developer account, go to Certificates, choose Pass Type ID Certificate and pick your pass type ID.
  2. Upload the request, then download the certificate Apple issues.
  3. Come back to to combine it with this key.

Combine Apple's certificate with its key

A .p12 holds both, protected with a password: it's what most tools ask for to sign passes.

1. Apple's certificate

2. Its private key

The key you just made

3. Apple's WWDR certificate (optional)

To keep the intermediate certificate with it. Apple publishes it on its certificate authority page.

Getting a Pass Type ID certificate

From Apple's Building a pass and its account help.

  1. Step 1

    Create a Pass Type ID

    In Certificates, Identifiers & Profiles, add an identifier, choose Pass Type IDs, and enter a description and a reverse-DNS identifier starting with pass., such as pass.com.example.loyalty.

  2. Step 2

    Make a request

    A certificate signing request, with a new private key. Keychain Access makes one on a Mac, or this tool's Make a request in any browser.

  3. Step 3

    Get the certificate

    Under Certificates, add a Pass Type ID Certificate, pick your pass type ID, upload the request and download the certificate Apple issues.

  4. Step 4

    Sign your passes

    Combine the certificate with its key into a .p12 for your signing tool. Every pass you sign must use the same pass type ID and team as the certificate.

Got a pass to check too? Open it in the .pkpass inspector.

Or let WalletPassAPI keep the key for you

Make the request in the dashboard and the key is created and kept, encrypted, with us: you upload Apple's certificate, and we sign and update your passes with it. No .p12 to look after.

Request accessHow credentials work

Questions

How do I get an Apple Wallet Pass Type ID certificate?

In Certificates, Identifiers & Profiles in your Apple Developer account, create a Pass Type ID. Then make a certificate signing request, choose Pass Type ID Certificate under Certificates, pick your pass type ID, upload the request and download the certificate Apple issues.

How do I turn a .cer into a .p12?

The .cer Apple gives you holds the certificate but not the private key, which was made with your certificate signing request. A .p12 holds both, protected with a password. Combine them in Keychain Access on the Mac that made the request, or here with the key file this tool saved.

Why does Wallet say my pass doesn't match its certificate?

The passTypeIdentifier and teamIdentifier in pass.json have to match the certificate the pass is signed with. Check the certificate here to see the pass type ID and team it was issued for.

What is the Apple WWDR certificate?

Apple's Worldwide Developer Relations intermediate certificate, which issues Pass Type ID certificates. A pass's signature has to include it; Apple lists leaving it out as a common error. Apple publishes each generation on its certificate authority page.

Is my certificate, key or password uploaded?

No. Files are read, checked and made in your browser, and nothing is sent to us or stored. The private key a request makes is created by your browser and saved straight to your device.