Provisioning Profiles
A provisioning profile = Certificate + App ID + (optional) Devices. Regenerate and re-download whenever any element changes — the single most important sentence in the whole signing system.
Profile Types
| Type | Use | Elements | Typical scenario |
|---|---|---|---|
| Development | Development/debugging | Development cert + App ID + devices | Xcode on-device debugging |
| Ad Hoc | Targeted test distribution | Distribution cert + App ID + devices | Real-device distribution without TestFlight |
| App Store | Release | Distribution cert + App ID (no devices) | Submission / build upload |
| In-House (Enterprise) | Enterprise internal | Enterprise cert + App ID | Enterprise distribution (requires Enterprise account) |
Creation Steps
- Go to Certificates, Identifiers & Profiles → Profiles → ”+”.
- Choose the profile type (Development / Ad Hoc / App Store).
- Select a certificate (prefer the latest Distribution or Development).
- Select the App ID (ensure required capabilities are enabled).
- For Development / Ad Hoc, select the device list.
- Name it, download the
.mobileprovision, and import into Xcode / CI.
Automatic vs Manual Signing
| Approach | Description | Best for |
|---|---|---|
| Automatic signing (recommended) | Sign in with Apple ID; Xcode manages certificates & profiles | Individuals / small teams |
| Manual signing | Manually choose certificate & profile | CI, complex multi-environment |
Automatic signing suits daily development; CI packaging usually uses manual signing or fastlane
match to centralize certificates/profiles for reproducibility.Maintenance & Updates
- After certificate renewal, device changes, or capability additions, regenerate the profile.
- CI: rebuild after updating certificates/profiles; fastlane
matchcentralizes their management. - An expired profile doesn’t affect already-published apps — only new build signing.
Troubleshooting
| Error / symptom | What to check |
|---|---|
| No provisioning profile found | Whether App ID, certificate, devices are all ready; regenerate the profile |
| Profile doesn’t include the device | Add the device UDID to the profile and regenerate |
| Entitlements mismatch | Whether App ID capabilities match Xcode configuration |
| Certificate mismatch | The certificate referenced by the profile must match the private key in Keychain |
Self-Check List
- Correct profile type created per environment
- Referenced certificate valid and contains the private key
- Profile regenerated after adding capabilities / devices
- CI / Xcode updated to the latest profile
- Submission builds use App Store / Distribution signing
Author’s Note
90% of signing errors point to the same thing: at least one of certificate, App ID, or devices doesn’t match the profile. When you hit an error, don’t panic — check each item against “Profile = Certificate + App ID + Devices” and you’ll usually locate the cause in minutes.