Notes to self for iOS distribution certificates with Phonegap Build (and no Mac).

Generate 2048 bit RSA private key:
openssl genrsa -des3 -out ios.key 2048

Generate CSR with that private key:
openssl req -new -key ios.key -out ios.csr -subj "/emailAddress=MY-EMAIL-ADDRESS, CN=COMPANY-NAME, C=COUNTRY-CODE"

Visit Apple Developer iOS Provisioning Portal > Certificates > Add.
Upload the CSR. Download the resulting .cer file.

Generate a PEM file from the .cer file:
openssl x509 -in ios_development.cer -inform DER -out ios_development.pem -outform PEM

Generate a p12 file:
openssl pkcs12 -export -inkey ios.key -in ios_development.pem -out ios_development.p12

Visit Apple Developer iOS Provisioning Portal > Provisioning Profiles.

If the distribution provisioning profile has not expired yet, edit it to use the new distribution certificate.

Otherwise, add a new provisioning profile using the new distribution certificate.

Click Generate to generate a new provisioning profile. Download it.

In Phonegap Build, upload the .p12 and provisioning profile to the account’s signing keys.

Update the existing provisioning profile with the new distribution