Re-signing and rebranding BMC MyIT for iOS

The following procedures describe how to re-sign and rebrand BMC MyIT so that you can deploy it to your end users who use iOS devices.


Before you begin, apply for the Apple Enterprise Program. After your membership has been approved, you can sign in to the developer portal. See the following links for more information:

  • Managing Your Team—Describes how to assign appropriate team roles. To complete the following procedures, you must assign the Team Agent role to the user who will create the certificate.
  • Accessing Member Center and iTunes Connect—See especially the "Managing Your Certificates, Identifiers, and Profiles" section.

The process involves the following procedures:

Installing the Xcode and Apple root certificate

You need to perform this procedure only once.

  1. On an Apple Macintosh computer, install the free Xcode from the App Store.
  2. Install the Apple root certificate:
    1. Go to
    2. Download the Apple Inc. Root Certificate.
    3. Double-click the file, and install it in the Keychain (login).

Creating an enterprise distribution certificate to re-sign BMC MyIT

  1. Log on to the iOS Provisioning Portal at with the Team Agent role.
  2. In the Certificates section, click the plus sign (+) to add the certificate.
  3. In the Production section, select In-House and Ad Hoc.
  4. Generate a certificate signing request (CSR) by using the Certificate Assistant.
     Follow the instructions that Apple provides on the CSR screen.
  5. Upload the CSR to the iOS Provisioning Portal, and download the distribution certificate.
  6. Save the certificate, and open it with the Key Chain Access application.
    Use this certificate to sign iOS applications.
  7. To export this certificate to a different build, save it in .p12 format:
    1. In Key Chain Access, go to the My Certificates section.
    2. Right-click the downloaded certificate, and click Export.
    3. Save the certificate in .p12 format, and provide a secure password when required.

Creating an application ID for your version of BMC MyIT

  1. Log on to the iOS Provisioning Portal with the Team Agent role.
  2. In the Identifiers section, click the App IDs tab.
  3. Click the plus sign (+) to add a new identifier.
  4. In the Description field, type a name that will easily identify your application to you within the portal (for example, Calbro MyIT).
  5. Make a note of the App ID Prefix (Team ID), which you will use in the re-signing process.
  6. Select Explicit App ID, and enter a unique identifier in the Bundle ID field (for example, com.customername.MyIT).
  7. Make a note of the Bundle ID for the re-signing process.
  8. In the App Services section, leave the defaults as they are, but ensure that Push Notifications is selected.
  9. Click Continue.
  10. Click Done to return to Identifiers list.

Creating your in-house distribution provisioning profile

  1. Log on to the iOS Provisioning Portal with the Team Agent role.
  2. In the Provisioning section, click the Distribution tab.
  3. Click the plus sign (+) to add a new profile.
  4. On the Create iOS Provisioning Profile page, complete the following steps:
    1. For Distribution Method, select In House.
    2. Select the distribution certificate that you created.
    3. Select the App ID that you created.
  5. Download the provisioning profile.
    You can use this profile to build the application for in-house deployment.

Creating your Apple Push Notification Service (APNS) certificate

  1. Log on to the iOS Provisioning Portal with the Team Agent role.
  2. In the Certificates section, click the Production tab.
  3. Click the plus sign (+) in the top-right corner.
  4. Select Apple Push Notification Service SSL (Production).
  5. Select the App Prefix ID (Team ID) that you created.
  6. Generate a certificate signing request (CSR) by using the Certificate Assistant.
    Follow instructions that Apple provides on the CSR screen.
  7. Double-click the certificate to download it and import it into your Keychain.

Re-signing the BMC MyIT.ipa with your enterprise credentials

  1. Unzip the ipa file.
    In the terminal application, enter the following commands:

    mkdir /path/MyIT-ResignDir (e.g. /User/bill/MyIT-working/MyIT-ResignDir)
    cd /path/MyIT-ResignDir
    unzip –oq /path/MyIT.ipa
  2. In a text editor, create a MyIT.entitlements file in the /path/MyIT-resign-ipa directory, and add the following lines:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "">
    <plist version="1.0">

    1. Replace the value for the application-identifier key with your team prefix and App ID.
      For example, where it says, replace it with your
    2. Replace the value for the keychain-access groups key with your team prefix and App ID.
      For example, where it says, replace it with your
  3. To rebrand the MyIT iOS client, edit the following icon and splash screen .png files.

    Do not adjust the size or format of the files. Doing so might cause the icons and splash screens to display incorrectly on the iOS devices.


  4. Place the provisioning profile that you created into the /path/MyIT-ResignDir folder , and rename the file to MyIT.mobileprovision.
    See Creating your in-house distribution provisioning profile for details about creating your own provisioning profile.
  5. Set the bundle ID (see the Apple Developer Site for more information), where CompanyDomain is your domain in reverse-DNS format (for example, com.acme) and MYIT-APPNAME is the unique internal application name for MyIT (for example, MyIT-Acme):

    cd /path/MyIT-ResignDir
    /usr/libexec/PlistBuddy -c "Set CFBundleIdentifier CompanyDomain.MYIT-APPNAME” ./Payload/
  6. Set the application name displayed on the iOS devices, where ApplicationName is the name of your MyIT application (for example, MyIT or AcmeMyIT):

    cd /path/MyIT-ResignDir
    /usr/libexec/PlistBuddy -c "Set CFBundleDisplayName ApplicationName" ./Payload/
  7. Set the default BMC MyIT server to your BMC MyIT server, where SERVER is your BMC MyIT server name (for example,

    cd /path/MyIT-ResignDir
    /usr/libexec/PlistBuddy -c "Set myit-server SERVER" ./Payload/
  8. Set the default port for your BMC MyIT server, where PORT is the TCP port for clients to access the server (for example, 80 or 443):

    cd /path/MyIT-ResignDir
    /usr/libexec/PlistBuddy -c "Set myit-port PORT" ./Payload/
  9. Replace the mobile provision file:

    cd /path/MyIT-ResignDir
    cp "MyIT.mobileprovision" "./Payload/"
  10. Re-sign the IPA, where CERTNAME is the name associated with your Apple Enterprise Certificate (for example, BMC Software, Inc.):

    cd /path/MyIT-ResignDir
    rm -r "./Payload/" "./Payload/"
    /usr/bin/codesign -f -s "iPhone Distribution: CERTNAME" --entitlements "MyIT.entitlements" --resource-rules "./Payload/" "./Payload/"
  11. Create the IPA zip file:

    zip -qr "MyIT-rebranded.ipa" Payload

Replacing the BMC MyIT APNS certificate with your APNS certificate

  1. Log on to the server that hosts the BMC MyIT server.
  2. Stop the Tomcat instance that executes the BMC MyIT server.
  3. Find the external-conf folder under the Tomcat home folder.
  4. Create a subfolder called certification.
  5. Place the p12 file containing your APNS certificate into the certification subfolder.
  6. Log on to the BMC Remedy Mid Tier of the BMC MyIT Data Access Component (AR System server) that is hosting your MyIT Administration Console forms.  
  7. Open the MyIT Administration: Push Notification Cert form.

    You can access this form directly with a URL. For example, if your mid tier’s host name is myhost and your mid tier’s port is 8080, you can access it with this link:


    For more information about accessing forms, see Enabling the AR System Object List in the BMC Remedy AR System documentation.
  8. Click New Search, and then click Search when the form reloads.

    If you are on a multitenant system, select from the result of the search that matches the tenant ID of the tenant that you want this certificate to be used with.

    If you are executing a system without tenants (which is the default configuration), you will see only Default Tenant, so select that one.

    The field values for that instance appear.
  9. If you are changing the iOS APNS certificate:
    1. In the iOS Push Notification Cert field, replace the current value (which is BMCiOSAPNSMyITMobile.p12, by default) with the name of the p12 file that contains your new APNS certificate.
    2. In the iOS Push Notification Password field, replace the current password with the password of your p12 file. (You will enter it in plain text.)
      The new value is encrypted after you save the changes.
  10. Click Save
  11. Start the Tomcat instance.

    Any notifications to iOS devices from your server (or tenant in multitenant environments) are sent using the new certificate.

Was this page helpful? Yes No Submitting... Thank you


  1. Doug Bagley

    Generating the APNS certificate there was never a prompt for a password or a password generated.  What is step 7 referring to?

    Nov 21, 2013 01:21
    1. Michele Marques

      It looks like your comment was addressed some time ago. Can you confirm?

      Jun 11, 2015 09:43