You probably know all this stuff already, but last time I needed to sign an iOS app without a Mac I put together a little guide for myself about all the openssl signing bits, at https://www.kryogenix.org/days/2014/02/11/building-a-phonegap-ios-app-from-ubunt.... Your use case may be different (in particular, I don't know how to build an ipa without a Mac, and I'm pretty confident that you actually cannot upload to the iOS App Store without one), but that may help with the signing parts if you don't already know it.