My company just built an app for a client who already has an Apple Developer account and had already created their Distribution Certificates. When the cert is downloaded to our build machine, it obviously isn't signed by us.
Is it possible for us to sign the cert they have already created so we can get the app submitted?
So I've addressed this one of two ways with my clients. Assumption here is that the client trusts you enough...
Ask for the client's Apple Developer login and password info, revoke the current distribution certificate and build a new one using your build machine. Boom! Sign and submit.
Ask the client to supply you with the private key he/she used to sign the original distribution certificate. This is done via Keychain Access (see Ronak's answer for specifics).
If said client gets leery about #1, he/she can change their development account password once the app gets submitted and approved, then revoke/make a new distribution certificate.
Getting your client's private key (#2) poses some security risks for your client, but it's the only other way I'm aware of.