Apple Passkit Integration

Overview

TL;DR: to issue Apple Wallet passes, you need a key and certificate signed by Apple which the pass has to be signed with.

Renewing Certificates

Certificates for Apple Passkit must be renewed every year. If you don't, membership passes signed with the key will fail to install.

Sign in to the Apple Developer shared account which owns ACM's developer information. You will then create a certificate here. Select "Pass Type ID Certificate" and in the dropdown for "Select a Pass Type ID for your Pass Type ID Certificate", select the Pass Type ID for QA (pass.org.acmuiuc.qa.membership) or Prod (pass.edu.illinois.acm.membership).

You will be asked to generate a CSR, use the following OpenSSL commands:

QA:

openssl req -new -newkey rsa:2048 -nodes -keyout passId.key -out passId.csr -subj "/emailAddress=infra@acm.illinois.edu/CN=pass.org.acmuiuc.qa.membership/C=US"

Prod:

openssl req -new -newkey rsa:2048 -nodes -keyout passId.key -out passId.csr -subj "/emailAddress=infra@acm.illinois.edu/CN=pass.edu.illinois.acm.membership/C=US"

Upload Cert to Core

Once the cert is signed and downloaded from Apple, convert to PEM format and then convert to Base64:

openssl x509 -inform DER -in pass.cer -out pass.pem
cat pass.pem | base64

Set that value to key acm_passkit_signerCert_base64 in the infra-core-api-config secret in Secrets Manager in the respective environment.

Upload Key to Core

cat passId.key | base64

Set that value to key acm_passkit_signerKey_base64 in the infra-core-api-config secret in Secrets Manager in the respective environment.

Upload Apple Signing Cert to Core

Every 10 years the Apple Worldwide Developer Relations - G4 certificate expires. Encode PEM file and update src/api/components/wwdr.ts.