Skip to content

MDX Toolkit v10.x – Command Line Wrapping in a Mac OS X Virtual Machine (VM)

When trying to execute the MDX Toolkit v10.x in a Mac OS X Virtual Machine you might be left with empty dialogue boxes:

mdx_toolkit_1  mdx_toolkit_2

This is due to the MDX Toolkit not running in a virtualized Mac OS X environment, thus having to revert to Command Line Wrapping.

Note: the following articles explain all the prerequisites and basic setup required for MDX Toolkit to work properly.


  1. How to get an APNS (Apple Push Notification Service) certificate for use with XenMobile MDM
  2. Installing and Configuring the Citrix MDX Toolkit Build 2.2.1 v372 and Wrapping Apps

As soon as all has been set up successfully you can start MDX wrapping with the Command Line tool CGAppCLPrepTool. It's quite easy actually as you only need to know the paths to your IPA files und where to place the MDX files.

The Syntax is as follows:

Usage: CGAppCLPrepTool [ Wrap | Sign | SetInfo | GetInfo ] -Cert CERTIFICATE -Profile PROFILE -in INPUTFILE -out OUTPUTFILE -appDesc DESCRIPTION -logFile LOGFILE -logWriteLevel LEVEL -logDisplayLevel LEVEL

Full help of Wrap script, with example
Wrap Command

-Cert CERTIFICATE ==> (Required)Name of the certificate to sign the app with
-Profile PROFILE ==> (Required)Name of the provisioning profile to sign the app with
-in INPUTFILE ==> (Required)Name of the input app file
-out OUTPUTFILE ==> (Required)Name of the output mdx file
-appName NAME ==> (Optional)Friendly name of the app
-bundleID BUNDLEID ==> (Optional)Bundle ID to be used for wrapped app (if different)
-upgrade ==> (Optional)Preserve in-place upgrade capabilty (not recommended for new apps)
-appDesc DESCRIPTION ==> (Optional)Description of the package
-minPlatform VERSION ==> (Optional)Minimum supported platform version
-maxPlatform VERSION ==> (Optional)Maximum supported platform version
-excludedDevices DEVICES ==> (Optional)A list of device type the App is not allowed to run
-logFile LOGFILE ==> (Optional)Name of the log file
-logWriteLevel 0-4 ==> (Optional)Log level for file
-logDisplayLevel 0-4 ==> (Optional)Log level for standard output
-storeURL url ==> (Optional; SDK) http://appstoreaddress/adHoc/citrix.ipa
-policyXML ==> (Optional) defaults to to usage of internal policy definition
-noStripExtensions ==> (Optional) Leave iOS extensions in app


For creating MDX package for IT admin:
Wrap -Cert "iPhone Distribution: Company Name" -Profile "distribution.mobileprovision" -in "input.ipa" -out "output.mdx" -appdesc "Test App Version 1.0" -minPlatform "7.0" -maxPlatform "9.0"


Example script for updating MDX package for ISV:
CGAppCLPrepTool SetInfo -in "/Users/joeadmin/apps/input.mdx" -out "/Users/joeadmin/apps/converted/output.mdx" -storeURL ""

Example script for resigning an IPA package:
CGAppCLPrepTool Sign -Cert "iPhone Developer: Joe Admin (12MMA4ASQB)" -Profile "team_profile.mobileprovision" -in "/Users/joeadmin/apps/input.ipa" -out "/Users/joeadmin/apps/resigned/output.ipa"

The basic command line looks like this:

./CGAppCLPrepTool Wrap -in "<ipaFile> -out "<mdxFile>" -Cert "<certName>" -Profile "<ProfileName>"


  • certName = the name of your APNS certificate
  • ProfileName = the name of your Apple Mobile Provisioning profile
  • ipaFile = the name of your IPA file (Input)
  • mdxFile = the name of your MDX file (Output)

For instance:

./CGAppCLPrepTool Wrap -in "./WorxWeb_10.0.07.41.ipa" -out "./WorxWeb_10.0.07.41.mdx" -Cert "iOS Distribution: Alexander Ollischer (3UTRVFVCW2)" -Profile "./iOS_Distribution.mobileprovision"

CGAppCLPrepTool can be found in ./Applications/Citrix/MDXToolkit:


In order for CGAppCLPrepTool to find the corresponding APNS certificate you have to place it under System in your local Keychain Access console:


Next you have to Trust the server certificate's issuer, e.g. the whole cain of certificates have to be trustworthy (in case they're not). Make sure the When using this certificate option is set to Use System Defaults, as custom trust policy settings might cause issues while wrapping apps:


Furthermore make sure the underlying certificate chain is valid, i.e. install the corresponding Issuer's CA certificate as well as intermediate certificates (Applications | Utilities | Keychain Access | System), in my case Apple Worldwide Developer Relations Certification Authority. Set the trust policy settings to Use System Defaults as well:


Reading the Citrix Blog XenMobile MDX Apps wrapping issues is recommended.

Last but not least: the corresponding Mobile Provisioning profile has been placed within the same folder as CGAppCLPrepTool (for convenience and ease of access), as well as corresponding IPA files:



Error: Failed to execute dylibcodesign with exit code: 1


Problem Cause:

  • Command Line Tools is not installed in the Xcode
  • Missing private key or chain from the distribution certificate
  • Distribution certificates with identical names

In my case I had an expired certificate in my Keychain that needed replacement:


The most recent Apple certificates can be download from

See CTX135253 and Jarian Gibson's article here.

I once had an issue with a missing Private Key along with my Provisioning Profile in my Key Chain. A valid and existing Private Key can easily be identified by clicking the corresponding Provisioning Profile and verifying wehther the Private Key exists:


Further reading:

Leave a Reply