General: Forums topic: Code Signing Forums subtopics: Code Signing > General, Code Signing > Certificates, Identifiers & Profiles, Code Signing > Notarization, Code Signing > Entitlements Forums tags: Code Signing, Signing Certificates, Provisioning Profiles, Entitlements Developer Account Help — This document is good in general but, in particular, the Reference section is chock-full of useful information, including the names and purposes of all certificate types issued by Apple Developer web site, tables of which capabilities are supported by which distribution models on iOS and macOS, and information on how to use managed capabilities. Developer > Support > Certificates covers some important policy issues Bundle Resources > Entitlements documentation TN3125 Inside Code Signing: Provisioning Profiles — This includes links to the other technotes in the Inside Code Signing series. WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing Certificate Signing Requests Explained forums post --deep Considered Harmful forums post Don’t Run App Store Distribution-Signed Code forums post Resolving errSecInternalComponent errors during code signing forums post Finding a Capability’s Distribution Restrictions forums post Signing code with a hardware-based code-signing identity forums post New Capabilities Request Tab in Certificates, Identifiers & Profiles forums post Isolating Code Signing Problems from Build Problems forums post Investigating Third-Party IDE Code-Signing Problems forums post Determining if an entitlement is real forums post Code Signing Identifiers Explained forums post Mac code signing: Forums tag: Developer ID Creating distribution-signed code for macOS documentation Packaging Mac software for distribution documentation Placing Content in a Bundle documentation Embedding nonstandard code structures in a bundle documentation Embedding a command-line tool in a sandboxed app documentation Signing a daemon with a restricted entitlement documentation Defining launch environment and library constraints documentation WWDC 2023 Session 10266 Protect your Mac app with environment constraints TN2206 macOS Code Signing In Depth archived technote — This doc has mostly been replaced by the other resources linked to here but it still contains a few unique tidbits and it’s a great historical reference. Manual Code Signing Example forums post The Care and Feeding of Developer ID forums post TestFlight, Provisioning Profiles, and the Mac App Store forums post For problems with notarisation, see Notarisation Resources. For problems with the trusted execution system, including Gatekeeper, see Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hello Apple Developer Support, I paid for the Apple Developer Program on Friday, October 16, 2026. The payment was approved (the invoice shows an amount due of 0.00), but my membership has still not been activated. It has been 7 days, and I have not received any email asking for documents, verification or more information. I am posting with the same Apple ID that I used for the enrollment and the payment. Purchase details (from the Apple invoice): Online order number: D005368439 Invoice number: MD20790795 Sales order number: AFG2425219 Invoice date: 2026-10-16 Product: Apple Developer Program (D4521G/A), 99.00, paid by credit card Name on the invoice: Victor Hugo, Brazil Enrollment details: My identity was already verified in the Apple Developer app with my passport. I intended to enroll my company: FRAME STUDIO SERVICOS DIGITAIS LTDA (Brazil). The invoice was issued in my personal name, so I am not sure whether the enrollment was registered as an individual or as an organization. What I need: Please check why my membership was not activated after the payment. Please confirm whether my enrollment is registered as an individual or as an organization. If anything is missing on my side (a document, a D-U-N-S Number or any other verification), please tell me exactly what to send. I need the membership to sign and notarize the macOS installer of our software, and our users are blocked until then. Thank you for your help. Victor Hugo FRAME STUDIO SERVICOS DIGITAIS LTDA

Hi, When I used Rork to sign in Apple Developer Account to test my App, I got this message below "Apple rejected the sign-in request before checking the credentials (Apple app-token request, HTTP 503). The client identity this app sends is probably out of date." Screenshot below Does anyone knows why? What should I do? Thanks!

iOS app installation fails with 0xe8008018 for company team, but succeeds with another Apple Account Hello Apple Developer Community, We are facing a persistent code-signing issue while installing iOS development builds on a physical iPhone. We have contacted Apple Developer Support multiple times, but we have not yet received a technical explanation for the root cause. Environment Xcode: 26.6 (Build 17F113) macOS: 26.5.2 (Build 25F84) Device: iPhone 12 Pro Max (iPhone12,5) iOS: 26.5 (Build 23F77) Company Team ID: T6MQ4RXG46 Development certificate: Apple Development: Muthoot Money Limited (3MH4U8W7M5) Error message When installing the app through Xcode, installation fails with: 0xe8008018 — The identity used to sign the executable is no longer valid. The full error also contains: MIInstallerErrorDomain Code=13 CoreDeviceError Code=3002 IXUserPresentableErrorDomain Code=14 ApplicationVerificationFailed Troubleshooting performed Verified that the development certificate is within its validity period. Checked the provisioning profile's expiration date and confirmed that the test device UDID is included. Verified the app signature locally using codesign --verify --deep --strict. Confirmed that the app's signing authority and TeamIdentifier match our company team. Tested both our existing application and a newly created minimal iOS project named SigningTest. Important finding The newly created SigningTest app also fails to install when signed using our company team. However, the same test app installs successfully on the same iPhone when signed using another Apple Account's team. This suggests that the issue may be related to the company team's signing configuration or another team-specific factor, although we have not identified the root cause. Questions What could cause iOS to reject a locally valid app signature with error 0xe8008018? How can we identify the specific certificate, provisioning, trust, or device-verification check that is failing during installation? Is there any additional diagnostic command or device log we should collect? Could this indicate a team-specific signing issue that requires investigation by Apple? We would appreciate any technical guidance from developers who have encountered and resolved the same error. Thank you.

Is anyone else seeing this? Apple's documentation says "Your distribution certificate is valid for three years from when it was issued" (https://support.apple.com/guide/deployment/distribute-proprietary-in-house-apps-depce7cefc4d/web). On 2026-10-13 our automation created a new iOS Distribution certificate on our Apple Developer Enterprise Program account through the App Store Connect API (POST /v1/certificates, type IOS_DISTRIBUTION, with a CSR). The certificate expires 2027-11-12, which is about 395 days. Our previous enterprise iOS Distribution certificate, created in April 2025, got the full 3 years (expires 2028-04-28). To rule out our automation, I created another iOS Distribution certificate manually in the Developer portal on 2026-10-16. It also had a validity of about 396 days. We have revoked both so they can't be used. Questions: Has the validity period for Enterprise Program iOS Distribution certificates changed? If so, where is it documented? Is anyone else seeing ~395-day certificates on Enterprise accounts, from the portal or the API? Is there a supported way to request a specific validity period? I have also opened a case with Apple Developer Support (case ID 102999420277).

I just purchased the Apple Developer Paid Account on the 3rd of October to start development on an App and hasn't been able to use it even once I’m having an iOS code-signing/provisioning issue where development/Ad Hoc builds complete successfully, but the app cannot be installed on my registered iPhone. The same issue occurs with builds produced through both Xcode and Expo EAS Build, so at this point I don’t think this is specific to EAS. When installing the app on the device, iOS shows: Unable to Install “Sencard” This app cannot be installed because its integrity could not be verified. The device logs give a much more specific error. Environment Apple Developer account type: Individual Team ID: 26K9NDX728 Main bundle identifier: com.sencard.mobile Widget extension bundle identifier: com.sencard.mobile.widgets App Group: group.com.sencard.mobile Physical iPhone registered in the Apple Developer portal Expo SDK: 57 EAS distribution: Internal / Ad Hoc The same device is included in both provisioning profiles The issue also occurs when building/installing through Xcode The application contains a WidgetKit extension, so there are two targets: Sencard com.sencard.mobile ExpoWidgetsTarget com.sencard.mobile.widgets Both targets use the same Apple Distribution certificate, with separate provisioning profiles as expected. Current signing configuration I completely reset the signing credentials and let EAS regenerate them. Both targets now use the same distribution certificate: Distribution Certificate Serial: 64FE74F9A8F0091A81671D9CDE9F7CDB The main application has its own active Ad Hoc provisioning profile: Bundle ID: com.sencard.mobile Provisioning Profile: 7D9CS7B97R Status: active Registered device: included The widget extension has a separate active Ad Hoc provisioning profile: Bundle ID: com.sencard.mobile.widgets Provisioning Profile: DY3D63UHPX Status: active Registered device: UDID: 00008130-************001C EAS reports: All credentials are ready to build @sencard/sencard (com.sencard.mobile, com.sencard.mobile.widgets) The build itself completes successfully. Device-side failure I captured the device system log while reproducing the installation failure. The important part appears to be Apple’s online provisioning authorization service rejecting the profile: online-auth-agent: The server returned: {"actions":["REJECT_PROFILE"],"authorized":false,...} online-auth-agent: Permanently rejected profile This is immediately followed by: installd(libmis.dylib): No online authorization (0x2) installd(libmis.dylib): validation failed because of failing online authorization (-402620392) Then MobileInstallation reports: The identity used to sign the executable is no longer valid. and: Failed to verify code signature of .../Payload/Sencard.app 0xe8008018 (The identity used to sign the executable is no longer valid.) Finally: Verification stage failed and the installation fails. What seems particularly significant is that the device contacts the online authorization service successfully, but the response is explicitly: "actions":["REJECT_PROFILE"] "authorized":false Things I have already tried I have done a fairly extensive clean reset of the signing configuration: Deleted the existing Ad Hoc provisioning profiles. Removed the existing distribution certificates from EAS. Revoked the corresponding distribution certificates in the Apple Developer portal. Created a completely new Apple Distribution certificate. Generated completely new Ad Hoc provisioning profiles. Verified that the provisioning profiles show as active in EAS. Verified that both profiles contain the physical iPhone being used for testing. Verified that both targets belong to Apple Team 26K9NDX728. Configured both the main app and widget extension to use the same distribution certificate. Created separate provisioning profiles for: com.sencard.mobile com.sencard.mobile.widgets Confirmed the App IDs still exist in the Developer portal. Confirmed the App Group exists and is assigned correctly. Confirmed the registered iPhone is present in the Developer portal. Rebuilt the app from scratch after regenerating all credentials. Confirmed that the EAS build succeeds. Reproduced the installation failure again on the physical device. Captured the iPhone system logs using idevicesyslog. Reproduced the problem with Xcode as well as EAS. Initially, before resetting the credentials, I also encountered a build-time error similar to: Provisioning profile ... doesn't include signing certificate "iPhone Distribution: ... (26K9NDX728)" I then deleted and regenerated the certificates/profiles and ensured both targets shared the same distribution certificate. That resolved the build failure — the application now builds successfully — but the resulting application is still rejected by iOS during installation with the REJECT_PROFILE / 0xe8008018 error above. What I’m trying to determine Is there some server-side state associated with my Apple Developer team/account that can cause a newly generated, apparently valid Ad Hoc provisioning profile to be returned as: REJECT_PROFILE by Apple’s online authorization service? Specifically: What causes online-auth-agent to return REJECT_PROFILE for a newly created provisioning profile? Can an Apple Developer team/account get into a state where newly generated Development/Ad Hoc profiles are rejected by device-side online authorization? Is there any additional server-side reset or validation Apple Developer Support can perform for Team ID 26K9NDX728? Is error -402620392 associated with a specific provisioning/profile authorization condition? Is there anything else I should inspect in the .mobileprovision file or code signature to determine exactly why Apple is rejecting it? Since I can reproduce this with both Xcode and EAS, is there any known issue affecting Ad Hoc/Development profile authorization rather than the build tooling itself? At this point I’m reluctant to keep generating new certificates and provisioning profiles because I’ve already done a complete signing reset and the newly generated profiles are still being rejected. Any guidance on what REJECT_PROFILE means internally, or what Apple Support should check on the Developer account/team, would be greatly appreciated.

My account was suspended in August and reinstated on 11 September. The reinstatement email pointed to the macOS notarization rules, so I assume the concern was Developer ID. Both of my certificates, Apple Development and Developer ID Application, show as revoked. That part I expected. What I did not expect is that a month later I still cannot create replacements. Xcode signs in, finds the team, lists the revoked certificates, and for any certificate type returns: "Communication with Apple failed. You are not allowed to perform this operation. Please check with one of your Team Admins." I am the Account Holder. App Store Connect lists "Access to Certificates, Identifiers & Profiles" among my permissions. developer.apple.com sends me to the "Need assistance with accessing your developer account?" form. Two questions for anyone who knows the signing side. Does this error mean certificate access for the team is still switched off after the reinstatement, rather than a role problem? And is there anything I can do from my end to get a new Apple Distribution certificate, or can this only be fixed on Apple's side? Developer Support has the case, 102950490774. Here I am only asking what the error actually means.

Hello, What is the supported revocation-status source or documented validation procedure for the following exact intermediate certificate, encountered in signatures on Apple-supplied Command Line Tools Python 3.9? This concerns first-party Apple code signing, not Developer ID, public TLS, or S/MIME. Certificate details Subject: CN=Apple Code Signing Certification Authority, OU=Apple Certification Authority, O=Apple Inc., C=US Serial: 0x21 (33 decimal) DER SHA-256: 5bdab1288fc16892fef50c658db54f1e2e19cf8f71cc55f77de2b95e051e2562 Validity: 2011-10-24 17:39:41 UTC to 2026-10-24 17:39:41 UTC Issuer: Apple Root CA Issuer DER SHA-256: b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024 Embedded CRL distribution point: http://www.apple.com/appleca/root.crl This intermediate has no Authority Information Access extension. Retained observations from 1 October 2026 At approximately 16:59 UTC, one request to: https://www.apple.com/appleca/root.crl recorded HTTP 200 and returned a 511-byte CRL with: thisUpdate: 2025-03-10 21:28:16 UTC nextUpdate: 2025-07-23 21:28:16 UTC SHA-256: 02b300d7e2edc09a33c0e98c0291da47932320761f6060ea8d7624f6e344f1dd At approximately 20:02 UTC, a separate request to: https://crl.apple.com/root.crl recorded HTTP 404 and returned a 287-byte HTML error body. This was an alternative HTTPS candidate; it does not establish the behavior of its HTTP counterpart. Neither request followed redirects or retried. Response bodies and normalized collector records were retained, but raw HTTP headers and stderr were not retained. These are limited observations from that date, not a claim about global service availability or key compromise. Questions Which current Apple-published source provides signed revocation-status evidence covering this exact intermediate? If the distribution point has moved, what is the authoritative replacement and how is its scope established? Which CP/CPS or documented first-party validation mechanism applies to this certificate? In particular, does Apple Certificate Policy v7.0 (20 March 2026), sections 2.1 and 4.10, cover this chain? If a public revocation-status service is no longer supported for this legacy first-party CA, what documented verification approach should be used, or which Apple team handles this question? I am not treating an expired CRL or an HTTP error as evidence that the certificate is revoked. I am also not assuming that a standalone CRL lookup reproduces macOS trust evaluation. I am asking for the supported source and verification procedure, not for a way to bypass validation, change trust settings, or re-sign Apple binaries. Thank you.

Hi everyone, I’m trying to get my iOS app running on a physical iPhone for real-device testing, but I’m blocked by a persistent code-signing issue in Xcode. The project compiles successfully, but when I select my physical iPhone as the destination, the build fails during the signing stage: errSecInternalComponent Command CodeSign failed with a nonzero exit code The app therefore never gets installed on the device. What I’ve checked: Xcode recognises my Apple Development certificate. security find-identity -v -p codesigning reports the identity as valid. The certificate is present in my login keychain. Keychain Access shows the certificate with its private key underneath it. My login keychain is unlocked. The keychain search list contains my login keychain and the System keychain. I checked both keychains for the corresponding private key. There are no custom trust settings. The particularly strange part is that signing fails outside Xcode too. I tested signing /usr/bin/true directly using the same Apple Development identity, and that also fails with: errSecInternalComponent I also attempted to repair the private key’s signing access/partition list, but received: The specified item is no longer valid. It may have been deleted from the keychain. Certificate situation Xcode → Manage Certificates currently shows two Apple Development certificates: One current certificate One older certificate marked “Not in Keychain” When I try to create a new Apple Development certificate, Xcode says: You already have a current Development certificate or a pending certificate request. This is the only Mac I have used with this Apple Developer account, so there isn’t another Mac from which I can recover or export the original private key. What should I do? I’m trying to understand the safest next step without making the certificate/keychain situation worse. Should I: Revoke the older certificate and create a new development certificate/private-key pair? Try to repair the existing signing identity/private key? Take another Apple-supported approach? The immediate goal is to get the app onto a physical iPhone so I can begin real-device testing, followed by QA/beta testing and App Store launch. Any advice on what is actually causing errSecInternalComponent in this situation, and the safest way to resolve it, would be greatly appreciated. I can provide additional Terminal output, screenshots, or Xcode logs if helpful. Thanks!

My two apps, com.qrafter.Qrafter and com.qrafter.QrafterPro, have been on the iOS App Store since 2011, and their App IDs still use my team's unique App ID prefix 99T3FA87E9 instead of the Team ID GH4CGS3B5H. I'm adding native Mac versions to the same App Store records (universal purchase), so the bundle IDs can't change. Every profile Apple generates for these App IDs pairs com.apple.application-identifier = 99T3FA87E9.com.qrafter.Qrafter with com.apple.developer.team-identifier = GH4CGS3B5H. iOS uploads are accepted, but Mac App Store validation (xcrun altool --validate-app -t macos) rejects even a minimal one-window app with exactly two errors: Invalid code signing entitlements. … the "99T3FA87E9.com.qrafter.Qrafter" value for the com.apple.application-identifier key … isn't supported. This value should be a string that starts with your Team ID, followed by a dot ("."), followed by the bundle ID. (90286) Invalid Provisioning Profile. … Invalid 'com.apple.application-identifier' entitlement value. (91130) Following "Code Signing Identifiers Explained" (thread 811970), I requested the prefix migration through Contact Us on 4 September (case 102953576372). On 20 September Developer Support asked me to confirm the one-time keychain data loss described in "App ID Prefix Change and Keychain Access" (thread 706128), and I confirmed. Since then the case has had no reply despite follow-ups on 24 and 29 September, and as of 6 October both App IDs still show 99T3FA87E9. Two questions: Is there anything else I need to do to get case 102953576372 completed, or a better route to escalate it? Is there any way to ship a Mac App Store build for these App IDs before the migration, or is the migration the only path? I have a minimal sample project and the full validation log if that helps.

I'm asking about how to ask for an addition to a managed entitlement, where we already have a grant of that entitlement (with a different value) and we already have other managed entitlements granted. This post https://developer.apple.com/forums/thread/789176 tells me I can request entitlements at the Requests tab here: https://developer.apple.com/account/resources/, which leads me to this form: https://developer.apple.com/contact/request/system-extension/ The form URL doesn't specify a particular App Identifier, but is the Identifier implied with this form submission? Or, put another way, is the entitlement we're asking for attached only to the Team ID, or also to the bundle ID of the app which is going to use the entitlement? So if I made another app which talks to my dext, I'd have to ask again for userclient-access to the same dext, but from a different bundle ID? The form says "Which DriverKit entitlements do you need" and "select all that apply", but I'm unclear about whether I need to request ALL the DriverKit entitlements we need for all our apps, or only for the specific App Identifier I reached this form from. It also isn't clear if I need to check both the USB Transport and the UserClient Access boxes in my case. We already have UserClient Access granted for at least one bundle ID, and I want to add another. We already have USB. Transport granted for two different vendor IDs. Do I need to mention that in my request here, and also check the USB Transport box, although I'm not requesting any new vendor ID values? I don't want to end up with new profiles which break new builds of existing apps which were relying on previously-granted entitlements that are now missing from the newly-generated profiles. Here: https://developer.apple.com/forums/thread/822652 user JackLongbow submitted a request for UserClient Access for two bundle IDs, presumably in the form of a simple two-line string like this: com.turing.TuringTouch com.turing.TuringTouch.TouchDriver but the resulting provisioning profile was malformed, it contained this value under com.apple.developer.driverkit.userclient-access <string>com.turing.TuringTouch com.turing.TuringTouch.TouchDriver</string> the Forum post said that the approved entitlement looks like this: <array> <string>com.turing.TuringTouch</string> <string>com.turing.TuringTouch.TouchDriver</string> <string>com.turing.TuringTouchDriver</string> <string>com.turing.virtualpad</string> <string>com.turingdraw.DigidrawTouch.DigidrawDriver</string> </array> Should I be formatting my request as above, as a chunk of xml, or is a plain text list of bundle IDs, one per line, acceptable? Is there a way for us to get a summary of all the managed entitlements already granted to our team? At present, it seems like I have to pick a particular profile, download it, and QuickLook at it - but not all profiles contain all entitlements, just as apps don't have to claim all the entitlements the profile offers .

Every App Store Connect upload I sign with my Cloud Managed Apple Distribution certificate is rejected with ITMS-90035 ("Code failed to satisfy specified code requirement(s)") for the app binary and its widget extension. It happens from Xcode Cloud and from a manual Organizer upload alike. I think I have found the cause, and it looks like a Unicode normalization bug in cloud-managed signing. The certificate holder's name contains an umlaut: "Apple Distribution: Jonathan Thorsten Müller (…)". In the certificate the "ü" is precomposed (NFC, UTF-8 c3 bc). In the designated requirement that the export writes into the signature it is decomposed (NFD, "u" + U+0308, UTF-8 75 cc 88): certificate subject CN ... 4d c3 bc 6c 6c 65 72 ... ("Müller", NFC) designated requirement leaf CN ... 4d 75 cc 88 6c 6c 65 72 ... ("Müller", NFD) The bytes differ, so the signature can never satisfy its own designated requirement. It reproduces with Xcode 27.0's App template, unmodified, and without uploading anything: Archive for a generic iOS device. With no distribution identity in the local keychain, export for App Store Connect to a folder (export options: method app-store-connect, destination export, signingStyle automatic). DistributionSummary.plist shows "Cloud Managed Apple Distribution". xcodebuild -exportArchive -archivePath MyApp.xcarchive -exportPath out -exportOptionsPlist ExportOptions.plist -allowProvisioningUpdates Verify the exported app: codesign --verify --strict -vv Payload/MyApp.app Result: "valid on disk", then "does not satisfy its designated Requirement". Compare the requirement with the certificate's subject: codesign -d -r- Payload/MyApp.app codesign -d --extract-certificates Payload/MyApp.app openssl x509 -inform DER -in codesign0 -noout -subject -nameopt RFC2253,-esc_msb | xxd The same archive exported with a regular Apple Distribution certificate (same name, private key in my keychain) writes the NFC form, verifies, and App Store Connect accepts that upload. That works for manual uploads only. Xcode Cloud always signs with the cloud-managed certificate, so I cannot distribute from Xcode Cloud at all. Setup: Xcode 27.0 (27A266a) locally and in Xcode Cloud, automatic signing, one team, no custom code-signing flags. Product name, bundle IDs and file names are plain ASCII. Questions: Is this a known issue with cloud-managed signing and non-ASCII certificate names? Is there a supported way to have Xcode Cloud sign without hitting it in the meantime? If you see ITMS-90035 on Xcode Cloud and your name (or your team's) has an accent or umlaut in it, you may be hitting the same thing: run step 3 on an exported IPA and check.

Hi, I have a hard time renewing my certificates. The double click on the .cer file just opens the Keychain Acces but doesn't install anything. I'm missing a step. Thanks in advance for your help.

I am new to macOS development and presently tearing my hair out trying to get a driverkit extension to build. I have tried following the instructions here: https://developer.apple.com/documentation/driverkit/communicating_between_a_driverkit_extension_and_a_client_app namely, disabling SIP, but I am still unable to get my extension to build. The instructions say to set the code signing identity to "Sign to Run Locally" for all three targets, but this is not listed as an option for the driver extension.

Hello, I am experiencing persistent ITMS-90034 when trying to upload the first iOS app from a newly enrolled Individual Apple Developer Program account. The exact error is: Validation failed (409) Missing or invalid signature. The bundle at "Payload/[App].app" is not signed using an Apple submission certificate. (ID: 90034) I have already performed extensive signing checks and troubleshooting: Apple Developer Program membership is active. A valid Apple Distribution certificate is installed in Keychain together with its private key. security find-identity -v -p codesigning reports both Apple Development and Apple Distribution as valid identities. The correct Team and Bundle ID are selected. Automatic signing is enabled in Xcode. Provisioning profile caches and DerivedData were deleted, profiles were downloaded again, and a completely fresh archive was created. Xcode's App Store Connect export review explicitly shows: Certificate: Apple Distribution App Store provisioning profile for the correct Bundle ID get-task-allow = false beta-reports-active = true I then exported the IPA locally using Xcode's App Store Connect distribution workflow and independently inspected the actual exported binary with codesign. The main application reports: Identifier=[Bundle ID] Authority=Apple Distribution: [Name] ([Team ID]) Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA TeamIdentifier=[Team ID] I also separately checked the embedded Capacitor.framework and Cordova.framework. Both are signed with the same Apple Distribution identity and Team ID and show the same WWDR -> Apple Root CA trust chain. I checked Keychain as suggested in similar forum discussions. The Apple Distribution certificate has its private key, the WWDR intermediate certificates are present and valid, and certificate verification reports: "...certificate verification successful." Despite all of the above, a fresh upload from Xcode Organizer still consistently fails with the same ITMS-90034. This appears very similar to other recent reports involving newly enrolled Individual Developer accounts where correctly signed binaries are rejected by App Store Connect. I also opened an Apple Developer Support case (case 20000149684934). So far I have received general signing/troubleshooting documentation, but the issue remains unresolved. At this point, is there any additional local signing verification I should perform, or could this indicate an account/team-level App Store Connect signing validation issue that needs to be investigated on Apple's side? I would especially appreciate guidance from Apple DTS on what diagnostic information would be useful to distinguish a local certificate-chain issue from an App Store Connect/account-side validation issue. Thank you.

When trying to develop an Apple Shortcut, the shortcut doesn't appear (after many open, quit, adding permissions, etc.). My only Apple Account is my name associated with an Apple ID of QZ99..... However, when I try to check one (of many reasons) why it does not show up with Terminal: codesign -dv --verbose=4 "/Applications/My App.app" etc, it shows something "rejected" Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA Signed Time=Aug 25, 2026 at 1:26:38 PM Info.plist entries=22 TeamIdentifier=QZ99... Runtime Version=26.5.0 Sealed Resources version=2 rules=13 files=4 Internal requirements count=1 size=204 /Applications/Write Create Date from Original.app: rejected origin=Apple Development: My Account (K533...) The K533... is different than my Team ID of QZ99... Could that be a reason my app is not registered with Shortcuts? Is that expected functionality? I guess I expected my Team ID to appear everywhere even after I deleted my account in Xcode, removed a current and expired certificate associated with K533 in Keychain, and then added my account back, and let Xcode regenerate a certificate.

Installing a development build on a physical iPhone fails with: 0xE8008018 - The identity used to sign the executable is no longer valid. On the same Mac, same iPhone, same codebase and same Xcode, switching to a free personal Apple ID team installs and runs with no error. Only builds signed with our paid organisation team fail. Nothing else changes between the two runs. We have already regenerated certificates and provisioning profiles, deleted the profiles folder, cleared DerivedData, removed old identities from the keychain, trusted the profile on device, and tried both automatic and manual signing. None of it changes the result. We have also gone through the existing threads on this error and none of the suggested fixes apply. The build validates locally but the device rejects the identity. Since the signing team is the only variable between success and failure, what should we be looking at? A support case is open with Developer Support but we have not had a technical response yet.

To rule out anything stuck on the original App ID, I created a completely new Bundle ID (br.com.minhapecuaria.ios2) from scratch: New App ID registered in the portal, Sign In with Apple capability enabled. New App Store provisioning profile generated and installed, tied to that Bundle ID. New app record created in App Store Connect for it. Manual signing in Xcode, explicitly selecting the new Distribution certificate + new profile. Verified via codesign/security cms -D: Apple Distribution identity, get-task-allow: false, no device list — a genuine App Store signature. Uploaded via Xcode Organizer → same result: error 90034 ("Missing or invalid signature... not signed using an Apple submission certificate"). Since this Bundle ID never existed before, there was nothing "stuck" on it — no stale provisioning history, no cached signing decision tied to that specific App ID. The fact that the error persists identically rules out anything project-specific and points squarely at the account/Team level (Team ID 395DDXTXHC). I've also opened a support case (20000125779862) with this exact evidence, but so far only received generic first-line responses (certificate basics, Feedback Assistant suggestions) that don't address the account-level nature of the issue. Posting here in case anyone has seen this specific pattern — same 90034 across two independent Bundle IDs/certs/profiles under the same Team.

Hello, I’m experiencing a persistent App Store Connect upload issue that seems unrelated to my project. Every upload is rejected with: Validation failed (409) Missing or invalid signature. The bundle is not signed using an Apple submission certificate. (Error 90034) What I have already verified: Apple Developer membership is active. I am the Account Holder. Apple Distribution certificate exists and is valid. App Store provisioning profile was recreated. Automatic signing is enabled. Archive is exported using “App Store Connect” distribution. The exported IPA is signed with Apple Distribution (verified with codesign). I tested both Xcode Organizer and Transporter. I created a brand new native Xcode “Hello World” project, and it fails with exactly the same error. The project contains no frameworks, no CocoaPods, no Swift Packages, no Flutter, no React Native, and no embedded binaries. Since even a brand new Xcode project fails, I believe this is related to my Apple Developer account or App Store Connect validation infrastructure rather than the project itself. Has anyone experienced this before or knows what else can be verified? Team ID: 395DDXTXHC Thank you.

There are currently 2 active certificates in the Apple enterprise developer account. One certificate belongs to one application is going to expire in a week, when I try to create a new certificate the option 'In-house and adhoc' is disabled with error text 'Maximum number of certificates generated'. This is the first time I encountered this issue. There was a 3rd certificate also, I have revoked 3 days back as that certificate not required, still displaying the same error. If anyone faced the similar issue in the past, please share how this can be solved.

Hi, I’m trying to submit my iOS app Minha Pecuária to App Store Connect, but Apple consistently rejects the build with: Validation failed (409) Missing or invalid signature. The bundle ‘br.com.minhapecuaria.ios’ is not signed using an Apple submission certificate. Error 90034. I have already verified that: The app is signed with an Apple Distribution certificate. The App Store provisioning profile is linked to the correct Distribution certificate and Bundle ID. Automatic signing is enabled in Xcode. The exported IPA was independently checked and shows Apple Distribution as the signing authority. The same error occurs through both Xcode Organizer and Transporter. I also reproduced the problem with a clean/new project. Could anyone from Apple or anyone who has experienced error 90034 confirm what could cause Apple’s server to reject a binary that is correctly signed with Apple Distribution? Thanks!