Skip to content
Get a quote

iOS signing errorXcode: provisioning profile is invalid, expired or doesn’t include your certificate

An iOS build that worked last week now stops with a signing error: “provisioning profile is invalid” or “expired”, “doesn’t include signing certificate”, “doesn’t include the currently selected device”, or a profile that doesn’t support a capability such as push notifications. The profile is the file that ties your app, your certificate, your devices and your app’s capabilities together, and any change to one of those can make it stale. Here is what changed, in Apple’s words, and how to regenerate it, or hand it over at a fixed price.

Short answer

Something the profile lists changed. You added a capability such as push notifications or Sign in with Apple, the certificate was revoked or replaced, a test device is missing, or the profile expired. Regenerate the profile in Certificates, Identifiers & Profiles, or turn on Automatically manage signing so Xcode does it. If a build service signs your app, give it the new profile too.

What made the profile stale, and the fix for each

  1. 01

    You added a capability, or the profile expired

    “If you enable or disable app services or if a provisioning profile expires, you need to regenerate the provisioning profile.” Apple, Edit, download, or delete provisioning profiles

    Turning on push notifications, Sign in with Apple, associated domains or another capability changes the App ID, and the old profile no longer matches it. Xcode then says the profile doesn’t support the capability or doesn’t include the entitlement. In Certificates, Identifiers & Profiles, open Profiles, select the profile, click Edit, then Generate, and download the new one. Apple then says to remove the expired profile from your devices in Xcode and sign the app again with the regenerated one.

  2. 02

    The certificate or a device isn’t in the profile

    “For example, edit a provisioning profile if you revoked a certificate or disabled a device contained in the profile.” Apple, Edit, download, or delete provisioning profiles

    doesn’t include signing certificate means the profile was made for a certificate you no longer sign with: a new Mac, a revoked certificate, or a teammate’s. doesn’t include the currently selected device means a test iPhone was never registered. Add the certificate or register the device, then edit and regenerate the profile.

  3. 03

    Let Xcode manage signing, unless you have a reason not to

    “Xcode-managed development provisioning profiles and distribution provisioning profiles don't appear in your developer account.” Apple, Edit, download, or delete provisioning profiles

    In the target’s Signing & Capabilities tab, Automatically manage signing creates and refreshes profiles for you when capabilities or devices change. Those profiles won’t show in your developer account, which is expected. Keep manual signing only when a build service or a client’s account needs a specific profile.

  4. 04

    Build services keep their own copy

    EAS, Codemagic, Bitrise and Fastlane sign with the profile you gave them. After regenerating, update it there too, for example with eas credentials for Expo, or the build keeps failing on the service while it works on your Mac.

Checked against the vendor’s docs on : Apple Developer help: Edit, download, or delete provisioning profiles.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Xcode “Signing requires a development team” · iOS push “no valid aps-environment entitlement” · Expo EAS build failed · TestFlight Missing Compliance

Questions

More on this error

Will regenerating the profile break the app that is live on the App Store?

No. The live app was signed when it was uploaded. A new profile only affects the builds you make from now on.

Do I need the Account Holder to do this?

Apple lists the Account Holder or an Admin as the roles that can edit profiles in the developer account.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.

Describe your problem All fixes