Hello

At the moment tke Keychain tool UI can't generate certificate signing requests with the ECC algorithm, it only supports RSA. I have to update it. Meanwhile you can generate such a certificate signing request "by hand" with the OpenSSL binary that comes with the toolchain.

Note that for this you need an ECC private key too, which means you'll have two private keys (associated with two sets of certificates): one with the RSA algorithm for code signing your iOS apps, and one with the ECC algorithm for your Apple Pay needs.

The syntax would be:

% step 1. Create ECC private key with 256 bits size
"%IOSUNITYBUILDER_PATH%\Toolchain\openssl.exe" ecparam -out my_apple_pay.key -name prime256v1 -genkey
%

% step 2. Create a Certificate Signing Request to obtain a certificate for use with this private key
"%IOSUNITYBUILDER_PATH%\Toolchain\openssl.exe" req –new –sha256 –key <your keyname> -nodes –out <your CSR filename>
%

The only data you need to supply when creating your CSR is: emailAddress (your Apple ID email address), CN (Common Name), C (Country, in two-letters abbreviation)

Let me know if you need more instructions. I take note to improve the keychain tool UI so that it can generate those types of private keys and CSRs.

:: @Pierre-Marie Baty added on 08 Apr ’24 · 10:23

Note: in step 1, "my_apple_pay.key" is the name of the file where your private key will be stored. Use it in place of the <your keyname> placeholder in step 2.