My original report was closed with notice that the issue has been fixed in iOS 27 beta 4. Unfortunately, while running iOS 27.0.1, I recently encountered this problem once again, but with a slightly different error message.
Failed to verify certificate chain due to client recoverable failure:
Error Domain=NSOSStatusErrorDomain Code=-67818 "“StoreKit Testing in Xcode” certificate is expired" UserInfo={NSLocalizedDescription=“StoreKit Testing in Xcode” certificate is expired, NSUnderlyingError=0x11ba5ef40 {Error Domain=NSOSStatusErrorDomain Code=-67818 "Certificate 0 “StoreKit Testing in Xcode” has errors: Certificate is not temporally valid;" UserInfo={NSLocalizedDescription=Certificate 0 “StoreKit Testing in Xcode” has errors: Certificate is not temporally valid;}}}
I managed to obtain the faulty certificate used by the OS using the following code and that certificate was indeed expired.
if let jws = try? await AppTransaction.shared.jwsRepresentation {
var header = String(jws.split(separator: ".")[0])
.replacingOccurrences(of: "-", with: "+")
.replacingOccurrences(of: "_", with: "/")
header += String(repeating: "=", count: (4 - header.count % 4) % 4)
if let headerData = Data(base64Encoded: header),
let json = try? JSONSerialization.jsonObject(with: headerData) as? [String: Any],
let chain = json["x5c"] as? [String],
let der = Data(base64Encoded: chain[0]) {
let url = URL.temporaryDirectory.appending(path: "StoreKitTestingInXcode.cer")
try? der.write(to: url)
print("Certificate written to \(url.path())")
}
}
Looks like there's a bug in iOS preventing it from creating a new certificate. The same issue with a different certificate was also observed on macOS 26.6 with a Catalyst app. I don't have any expired certificates in my Keychain, so it looks like this problematic certificate can't be deleted by the user alone.
New report: FB25081130
