PEM - Maintain your push certificates

Twitter: @KauseFx License Gem

Tired of manually creating and maintaining your push notification profiles for your iOS apps? Tired of generating a pem file for your server?

PEM does all that for, just by running pem.

To automate iOS Provisioning profiles you can use sigh.

Felix Krause (@KrauseFx) the developer of PEM
Sebastian Mayr (@sebmasterkde) who implemented the download mechanism of signing certificates
Alexander Schuch (@schuchalexander) who automated the generation of the signing request

FeaturesInstallationUsageHow does it work?TipsNeed help?

PEM is part of fastlane: connect all deployment tools into one streamlined workflow.


Well, it's actually just one: Generate the pem file for your server.

Check out this gif:



sudo gem install pem

Make sure, you have the latest version of the Xcode command line tools installed:

xcode-select --install



Yes, that's the whole command!

This does the following:

  • Create a new signing request
  • Create a new push certification
  • Downloads the certificate
  • Generates a new .pem file in the current working directory, which you can upload to your server

PEM will never revoke your existing certificates.

If you already have a push certificate enabled, which is active for at least 30 more days, PEM will not create a new certificate. If you still want to create one, use the force:

pem --force

You can pass parameters like this:

pem -a -u username

If you want to generate a development certificate instead:

pem --development

Set a password for your p12 file:

pem -p "MyPass"

You can specify a name for the output file:

pem -o my.pem

To get a list of available options run:

pem --help
Like this tool? Be the first to know about updates and new fastlane tools

Environment Variables

In case you prefer environment variables:

  • PEM_SAVE_PRIVATEKEY - Set to "1" to save the private RSA key

How does it work?

There are 2 actions involved:

  • Accessing the iOS Dev Center to download the latest aps_production.cer. See: developer_center.rb.
  • Generating all the necessary profiles and files to prepare the finished .pem file. See: cert_manager.rb.
  • The .certSigningRequest file will be generated in signing_request.rb

How is my password stored?

PEM uses the password manager from fastlane. Take a look the CredentialsManager README for more information.


fastlane Toolchain

  • fastlane: Connect all deployment tools into one streamlined workflow
  • deliver: Upload screenshots, metadata and your app to the App Store using a single command
  • snapshot: Automate taking localized screenshots of your iOS app on every device
  • frameit: Quickly put your screenshots into the right device frames
  • sigh: Because you would rather spend your time building stuff than fighting provisioning
  • produce: Create new iOS apps on iTunes Connect and Dev Portal using the command line
  • cert: Automatically create and maintain iOS code signing certificates
  • codes: Create promo codes for iOS Apps using the command line
Like this tool? Be the first to know about updates and new fastlane tools

Use the 'Provisioning Quicklook plugin'

Download and install the Provisioning Plugin.

It will show you the pem files like this: assets/QuickLookScreenshot.png

Need help?

  • If there is a technical problem with PEM, submit an issue.
  • I'm available for contract work - drop me an email: [email protected]


This project is licensed under the terms of the MIT license. See the LICENSE file.


  1. Create an issue to discuss about your idea
  2. Fork it (
  3. Create your feature branch (git checkout -b my-new-feature)
  4. Commit your changes (git commit -am 'Add some feature')
  5. Push to the branch (git push origin my-new-feature)
  6. Create a new Pull Request