I've just started the process to distribute a new iOS app. And I can definitely admit to heaps of confusion.
Here's the setup. I've been developing the application with my boss's development certificate. All the provisioning and such has been done with his Apple Developer account.
Now that we're preparing for distribution, we're going to use the client's Apple Developer account. I have access to the this account, but I've also added myself through iTunes Connect as a Technical user.
Now, I know I need to get a development certificate first, but I don't know for whom. When I log in as myself (again, Technical role) I don't have access to the Provisioning Portal.
So do I need to log in as the client and create a certificate for him using Keychain from my Mac?
You'll need to create a certificate request on your mac, using the identity of your client. Login to his portal and approve the certificate, then download it to your machine and install it. When you build applications for that client, you'll need to be sure the correct certificate is selected in the build settings for the project. The most up to date instructions for these steps is always in the iTunes Connect site.