Another reason you may see this error that I haven't seen posted yet, especially if you are using Jenkins, is that your certificate's private key needs "Allow all applications to access this item" selected.
- Open your Mac keychain
- Go to "Certificates" or "My Certificates" under "Category" on the left.
- Find the cert you're trying to sign with, and click the little grey triangle on the left of the certificate to reveal the associated private key.
- Left/ double-click the private key and select "Get Info."
- Toggle from "Attributes" to "Access control"
- Select "Allow all applications to access this item" and save changes.
I maintain a large cluster of Mac mini nodes as part of a centralized Jenkins CI system, and this can come up.