Hi everyone, I maintain an app that is developed and distributed with an Apple Developer Enterprise subscription and delivered via my institution’s private site, where users download the .ipa file after logging in. From what I see, we use automatic signing in Xcode where possible. On the 1st of January 2024, the provisioning profile expired, and the developer before me had to rush to renew it because the app stopped working. Now, I have some questions about how to prevent this from happening again: When should I renew the provisioning profile? Can I renew it before the expiration without blocking the current app version that users have already downloaded? How do I renew it? If I need to download a certificate, does it need to be converted into a different format? Do we need to build a new .ipa file that users will have to download before the expiration date? here a screenshot clearance and guide:

Recently I noticed that when I build and archive my app with Xcode Cloud, it fails due to code signing issue. But that's weird because I have all development and distribution certificates. Does anyone have any idea how to solve this?

We want to make an app for the customers to install ipa files without use of third party apps or Other devices like Xcode, ITunes

Starting Point I recently transferred an app from an old to a new developer account. The transfer itself went smoothly with the app using the following capabilities: CoreData, CloudKit, Push Notifications, In-App Purchases Keychain is not used After completing the app transfer, I worked on a new update. For this, I set the new developer account as the development team of the project in Xcode. However, as soon as I try to install the new version locally on my physical test device, I get the following error message: application-identifier entitlement string ({new_team_id}.{bundle_id}) does not match installed application's application-identifier string ({old_team_id}.{bundle_id}); rejecting upgrade.` (Note: The test device has the latest production version installed, which was still published by the old developer account. The update can be installed without any problems if no previous version is installed. {new_team_id}, {old_team_id} and {bundle_id} are a substitute for the original content.) What I've tried so far I found a Technical Note on this topic and followed the steps suggested. However, the Apple Support wasn't able to provide me with the required Special Provisioning Profile. That's why I tested a different approach with a dummy application: I have completed an update as described above (new developer account selected as development team). Next, I uploaded it to App Store Connect and published it as a new version. I received the following warning during the upload process, but ignored it since I don't use the keychain: At first glance, the publication process appears to have gone smoothly. While the update caused the above error during local testing, the update via the App Store went smoothly. As the latest production version has now also been published from the new Apple Developer Account, further updates can now also be tested locally on a physical device without any problems. Questions Why is it that the update causes an error when tested locally, but works without problems via the App Store? Can this approach also be used without concern for an app with a large active user base, which also uses the capabilities described above (in particular CoreData & CloudKit) without causing problems? Thanks a lot for your support in advance!

Hello there! I found the page on Docs about Editing provisioning profiles: https://developer.apple.com/help/account/manage-profiles/edit-download-or-delete-profiles/ but there, are showed only cases where one should edit it or when it is expired. It is not showed the case where the profile IS ABOUT to expire. What If it is about to expire and I want to act before expiring? Somewhere on the forum I read that clicking "save" with no changes could be enough, but it is not clear to me if I need to choose something more about it. I add a screenshot since It seems to me the UI changed a bit recently. using Enterprise developer program, in-house distribution I can see no certificate with dec 31 2025 (+ - 1 day) on my dev page certificates list. but I have, among my certificates, an iOS distribution certificate with exactly nov 23 2026 es expiration date. why are two choices present with two different expiration dates? with which criteria should I pick one or the other? if I have no need to change something, what should I do or do not in this screen at renewal time? (I.E. at beginning of December 2024?) app Id should be the bundle id, is it so? but in this moment app and id are different, shouldn't they be the same?

I've been working on creating a CSR for about two hours now and I cannot find a Certificate assistant anywhere. I can open up keychain access, on the left I have login and cloud and system and system roots. there are 6 submenus under keychain access: All Items, Passwords, Secure Notes, My Certificates, Keys, and Certificates. I have used the search menu to find both in the search bar 'Certificate Assistant" and also Certificate Signing Request, and neither is anywhere to be found. I've looked on the developer Account help, I've read several places what you are supposed to do, I've see the illustrations where you enter the email and leave the CA email blank, I just can't find it anywhere around Keychain access. It is really really well described on the Developer account help, and the eskimo makes it sound really easy too, only nothing appears in my keychain access. I've scrolled through all of the submenus trying to find it and it is nowhere to be fount. Any help would be much appreciated

I am new. I have never used Swift nor XCode or the CLI. But I have found and managed to test my App that I created for testing on my iPhone. I have absolutely no intentions to put it on the App Store. I even made it Open-Source on GitHub. I learned a lot of things and ways to prevent crashes, but unfortunately I am slowly starting to lose the ability to put my App on my iOS. I am new here as a developer. But I have troubles to create a Developer Account, so I am not sure what I should do. Here's what I think I am having issues with: I feel like you can only create a Developer Account if you have a business, is this true? I really find it cool to test my own App on my own phone. But I want to do it in an official way. But I don't know how. Others have told me that you'd need a License for the App Store. But I am not trying to put it on the App Store, will this make it impossible for me to test my own app? Why make an app if not putting it on the App Store? You can learn. If you make good Apps or Libraries, you can provide them to other Developers! Maybe even an opportunity to collab with someone and even indeed put it on the App Store with a valid Developer Account. Seriously, if I wouldn't have been able to test my iOS app through other ways on my iPhone, I'd have never been able to make a short breakdown about AVAudioEngine and AVAudioSession. I've seen people that have run into these crashes. I tried to look up for a fix, but found none. I saw apps that allowed you to use a Microphone on a Laptop/PC and I decided to make my own one to test, and succeded, while I yet need to figure out a few crashes, I managed to do it, and I really want to continue and actually use my own App... So I was really happy that I could make a post to provide a guide in hopes that it would help someone. And I would do more, but I really need help with figuring out how I can test my own app on my own phone. I hope that Developer Relations can help with this.

TL;DR - What have I messed up on this notarization workflow? I'm completely new to Apple development. I have been trying to notarize an application I have written, that is then packaged as a .dmg. I am trying to notarize it using the command line tools (as it is an existing app, and not written in Xcode/Swift). My steps so far are as follows: All libraries, frameworks, and other executables have been signed (.dylib, .so etc.). I have avoided using --deep as I understand this is not recommended. The above includes all similar files included within zip archives (the cross platform framework I use places some inside a zip container). I have unzipped, signed, and rezipped. I have signed the main executable within "[NAME].app/MacOS" and the "[NAME].app" with an .entitlements file, and a certificate. codesign --verify --verbose --sign "$DEVELOPER_ID_APP_CERT" --timestamp --force --entitlements "$APP_NAME.entitlements" "$BUILD_DIR/$APP_NAME.app/Contents/MacOS/$APP_NAME" codesign --verify --verbose --sign "$DEVELOPER_ID_APP_CERT" --options runtime --entitlements "$APP_NAME.entitlements" "$BUILD_DIR/$APP_NAME.app" --force --timestamp echo "Checking for unsigned components..." codesign --verify --deep --verbose=4 "$BUILD_DIR/$APP_NAME.app" echo "Verifying entitlements..." codesign --display --entitlements :- "$BUILD_DIR/$APP_NAME.app" Both of the above checks come back as ok. Then, I have the following script lines which package the app as a .dmg and submit it to notarisation. hdiutil create -volname "$APP_NAME" -srcfolder $BUILD_DIR/$APP_NAME.app" -ov -format UDZO "$BUILD_DIR/$DMG_NAME" # Sign the DMG codesign --force --verify --verbose --sign "$DEVELOPER_ID_APP_CERT" "$BUILD_DIR/$DMG_NAME" # Notarize the DMG xcrun notarytool submit "$BUILD_DIR/$DMG_NAME" --key "[AUTH_KEY_LOCATION].p8" --key-id "[KEYID]" --issuer "[ISSUERID]" --wait # Staple the notarization ticket to the DMG xcrun stapler staple "$BUILD_DIR/$DMG_NAME" # Verify the notarization xcrun stapler validate "$BUILD_DIR/$DMG_NAME" After a 20 hour wait, I get the following back from the notarization service: id: 41931e00-2f34-4389-b5e1-fd76707c2162 status: Invalid Processing: [PATH]/[APP].dmg CloudKit query for [APP].dmg (2/a428f96446e143497380c0ae1f2b70661050aed6) failed due to "Record not found". Could not find base64 encoded ticket in response for 2/a428f96446e143497380c0ae1f2b70661050aed6 The staple and validate action failed! Error 65. Processing: [PATH]/[APP].dmg FotoLabAI.dmg does not have a ticket stapled to it. On a seperate submission, I noticed something about a note about audit.log not being found, but I can't find a reference to this on Google. So far as I understand, this is the file that is supposed to help me debug notarization errors. Normally I'd try more debugging myself, but I can't afford to wait 24h for feedback.

When installing the application on my iPhone, connected using USB cable, i am facing the following issue: ERROR: The application failed to launch. (com.apple.dt.CoreDeviceError error 10002 (0x2712)) NSLocalizedRecoverySuggestion = Provide a valid bundle identifier. NSLocalizedFailureReason = The requested application VALID_BUNDLE_IDENTIFIER is not installed. BundleIdentifier = VALID_BUNDLE_IDENTIFIER ---------------------------------------- The operation couldn?t be completed. (OSStatus error -10814.) (NSOSStatusErrorDomain error -10814 (0xFFFFD5C2)) _LSFunction = runEvaluator _LSLine = 1734 10:02:16 Acquired tunnel connection to device. 10:02:16 Enabling developer disk image services. 10:02:17 Acquired usage assertion. error MT1045: Failed to execute 'devicectl': 'devicectl -j /var/folders/vq/cdyy2xmd7g9cly1gh_hzvsj00000gn/T/tmp93djQj.tmp device process launch --terminate-existing --device "User’s iPhone" VALID_BUNDLE_IDENTIFIER --monodevelop-port 10000 --connection-mode usb' returned the exit code 1 Xcode version used: 15.4 IDE used to deploy the app: Visual Studio for MAC

I am signing my app using this command: codesign --verbose=4 --force --options=runtime --deep --timestamp --sign "${APP_IDENTITY}" "${APP_FILE}" --entitlements "./Protect.entitlements I have ensured that the necessary provisioning profiles are embedded in the IPA file. I am also verifying the signing using codesign -dvv ./JumpCloud\ Protect\ Staging.ipa and codesign --verify --deep --verbose ./JumpCloud\ Protect\ Staging.ipa Despite following the above steps, when I attempt to upload the IPA file to Transporter, I receive the following error message: Missing or invalid signature. The bundle 'com.jumpcloud.JumpCloud-Protect.staging' at bundle path 'Payload/JumpCloud Protect Staging.app' is not signed using an Apple submission certificate.

Hello there, I need guidance understanding what some certificates are related to. a) On my Apple developer page home I see that RENEWAL date for my apple developer enterprise program subscription is 2024-october-10 b) in devices section, there is a banner showing that my membership will EXPIRE on 2024-october-09 c) in certificates section I have 6 "development" certificates expiring in multiple dates from 2024-october-11 to 2025-may-22. these ones are "certificate Type - development" and **"certification name with my personal name" ** none of dates in certificates section matches exactly renewal or expiring dates for my apple developer page subscription or profile certificate. why dates in a and b are different? what are certificates in certificates section (those mentioned in "c") ? they seems different from "mac development" and such. What happens if they expire? thank you in advance.

Our company changed its name as a result of a merger, and the development group responsible for our mobile apps decided to migrate from our "legacy" Apple developer account to a new account associated with the new company name. I found this out last Friday when the notification step in the build script for our Mac applications stopped working — the notification server accepts the request but never responds; we were using the --wait flag with notarytool, and as a result it hangs indefinitely. Apparently our old developer account was deactivated unexpectedly, and while it's been temporarily turned back on to allow the mobile apps team to finish migrating their apps, the notarization step continues to hang. I haven't yet tried using the new team account, because my product requires an Endpoint Security entitlement, which is associated with the old Team ID. The long-term answer is probably to re-apply for a new entitlement, but that took over a month the last time we did this, and of course we were scheduled to release a product update in two weeks. At the moment we're dead in the water. Are there any other options to get us going again? (I considered opening a code-level support request, but as this issue isn't exactly "code-level", I was worried that would be a waste of time and/or money.)

We have developed an electron app which we want to extend with an action extension. The action extension is written in swift in Xcode. Our plan was to build the .appex file and insert it into the PlugIns folder in our electron app, but I don't think this is the right way to do it? If we insert the .appex file before notarization then we get an error that we are "replacing existing signature". If we manually insert it after the notarization then we get an error with the app is damaged and can’t be opened. Can anybody provide a procedure for this kind of merge I would imagine that it goes something like: Sign app Sign extension Add extension to App Notarize app For signing the app we use electron-builder.

PLATFORM AND VERSION macOS Development environment: Other: Python Run-time configuration: macOS 14.6.1 DESCRIPTION OF PROBLEM We have created application using python and created .app using pyInstaller. We want to get the location access using python based application which we are trying to run on MacOS 14.6.1. Without including NSLocationUsageDescription in our info.plist, it is working fine but not getting location permission pop up. After including NSLocationUsageDescription in info.plist application got corrupted. STEPS TO REPRODUCE We are using below commands to sign the application codesign --force -s "Developer ID Application: Pitney Bowes (72NX38Y9GF)" -v DeviceHub.app --deep --strict --options=runtime --entitlements ../info.plist DeviceHub.app ditto -c -k --keepParent --rsrc --sequesterRsrc --arch 'x86_64' DeviceHub.app DeviceHub.zip xcrun notarytool submit DeviceHub.zip --keychain-profile "DHAgentProfile" --wait xcrun stapler staple DeviceHub.app

When I trusted my certificate in 'Setting'->'VPN & Device Management', my device reboot automatically. After reboot, it showed that "developer of My Team is not trusted in this iPhone", but the app is "verified" in the second column. The UI looks like: iOS18 beta: First Col: Trust "My Team" Second Col: MyApp Verified Other versions: First Col: Delete App Second Col: MyApp Verified What's more, my app has plugins(extensions), my app can run normally while the extension is not able to be pulled up on iOS18 beta.

Hello everyone, **I created a certificat using openssl using the steps below ** Generate a Certificate Signing Request (ecccertreq.csr) Generate key pair in a key file Code openssl ecparam -genkey -name prime256v1 -out ecckey.key Generate CSR from key pair in key file Code openssl req -new -sha256 -key ecckey.key -out ecccertreq.csr -subj '/O=Nahdi Merchant Identity' Upload the Payment Processing Certificate CSR Download the Apple signed Payment Processing Certificate The certificate file (apple_pay.cer) appears in my Downloads folder Generate the .p12 file (ecckeystore.p12) Convert apple_pay.cer to PEM Code openssl x509 -inform DER -in apple_pay.cer -out apple_pay.pem Import merchant certificate and private key to generate .p12 Code openssl pkcs12 -export -out ecckeystore.p12 -inkey ecckey.key -in apple_pay.pem But I am getting this error when testing using the curl_test.php file and also when trying to make a payment on our website, we already have a working certificat for another merchant id and we don't get the same error Verbose info: cURL Error 56 - OpenSSL SSL_read: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca, errno 0 Verbose information * Trying 17.141.128.71:443... * TCP_NODELAY set * Connected to apple-pay-gateway.apple.com (17.141.128.71) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs * SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 * ALPN, server accepted to use http/1.1 * Server certificate: * subject: businessCategory=Private Organization; jurisdictionC=US; jurisdictionST=California; serialNumber=C0806592; C=US; ST=California; L=Cupertino; O=Apple Inc.; CN=apple-pay-gateway.apple.com * start date: Jul 24 19:05:42 2024 GMT * expire date: Oct 22 19:15:42 2024 GMT * subjectAltName: host "apple-pay-gateway.apple.com" matched cert's "apple-pay-gateway.apple.com" * issuer: C=US; O=Apple Inc.; CN=Apple Public EV Server RSA CA 1 - G1 * SSL certificate verify ok. > POST /paymentservices/paymentSession HTTP/1.1 Host: apple-pay-gateway.apple.com Accept: */* Content-Length: 131 Content-Type: application/x-www-form-urlencoded * upload completely sent off: 131 out of 131 bytes * OpenSSL SSL_read: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca, errno 0 * Closing connection 0 code-block

At some point I had to renew my Mac App Store certificates, so I've done so, and now that I'm attempting to build for submission to the app store, I'm getting: "No certificate for team 'My Name' matching '3rd Party Mac Developer Application: My Name (MY_ID)' found". But where to get a 3rd Party Mac Developer Application certificate? Under Xcode's "Manage Certificates", there is no "3rd Party Mac Developer Application" under the "+" button. There are only: Apple Development Apple Distribution Mac Installer Distribution Developer ID Application Developer ID Installer (all of which I have).

I've followed all the posts (most of which are fairly stale). I've generated dozens of certificates both for "Apple Development" and "Apple Distribution", created several profiles of "iOS App Development" and "App Store Connect". Up until now I have had very little problem installing my app (generated using Ionic/Capacitor v5/Angular v16, Xcode 15.4, macos 14.6). Now when I try to install directly on a test device (I've used regularly, previously), I get "Failed to verify code signature of... The identity used to sign the executable is no longer valid..." I've restarted Xcode and macbook. I've deleted all certificates and revoked all profiles, and started over. I have tried using automatic signing and manual signing. Nothing is working. I just want be able to install the app on a test device (mostly to see logs in Xcode's console), and to be able to upload the same app to appstoreconnect. What am I doing wrong?

I am using Xcode Cloud to build my Mac Catalyst app for Developer ID Distribution as a DMG package that must be codesigned and notarized. I have a ci_post_xcodebuild.sh script that runs after the Archive action. This needs to perform the following tasks: Produce a DMG from the provided exported archive located at CI_DEVELOPER_ID_SIGNED_APP_PATH Codesign that DMG using the same certificate identity that Xcode Cloud used when automatic code signing the exported archive using cloud signing. Notarize that code signed dmg with the notary service Generate a Sparkle appcast.xml file Upload the DMG and appcast.xml file to s3 The issue I am having is that I do not have access to the cloud signing keychain identity that Xcode Cloud uses to automatically codesign the exported archive. I check for identities and none are found. Running: security find-identity -v -p codesigning There are no code signing identities available. Make sure you have a "Developer ID (Application)" certificate (with the private key) installed on your Mac with Keychain Access. How can I access the cloud signing identity in this script so I can sign my DMG file before notarizing it? I am currently experimenting with installing my own certificate in the build server keychain and run my own archive + export commands after the Build action completes. This is not ideal. Thanks, Andrew

Hi! I develop my own NFC reader as a sole proprietor. I would like to get the Apple VAS and Apple Access Pass certificates for my reader. How can I do that? Should I apply for Apple’s MFi program or it’s just for bigger organizations/companies? Are there any way? Thank you! Daniel