iOS re-signing: common use cases and issues

In this blog post I would like to show you some iOS code signing issues and common use cases of iOS app re-signing where our Updraft re-signing service can support you and make your iOS development process more efficient.

iOS code signing is a complex thing. Often the errors that occur when installing an iOS app are not necessarily due to faulty code, but due to the incorrect signing of the iOS app. Modifying app entitlements, updating iOS distribution certificates and replacing provisioning profiles are therefore key tasks in iOS app management and essential for maintaining functionality, security, and compliance.

I would like to discuss the following iOS re-signing use cases in this blog post: 

• Adding new app features that require updated entitlements

• Renewing or replacing distribution certificates to avoid expiration and maintain app distribution

• Responding to distribution certificate revocation to restore app trust and functionality

• Transferring apps between developer teams, necessitating re-signing with new certificates

• Resolving provisioning profile issues to ensure continued app installation on devices

• Adding or removing iOS devices

• Changing the display name of your app

• Changing the version or build number of your iOS app

To better understand the whole code signing process you can also read the following instructions in our blog post “iOS Code Signing, Development and Distribution Provisioning Profiles explained” first.

Modifying app entitlements

Changing app entitlements is often needed to adapt to evolving functional requirements for app functionality or for internal, enterprise or app store distribution. App entitlements define the app permissions and capabilities an app has, such as access to certain device system features, services, or device resources. Features could be: push notifications, iCloud storage, HealthKit, app clips, sensors and many more: https://developer.apple.com/documentation/bundleresources/entitlements .
Whenever you add a new functionality to your app, you need to re-check if there is a related entitlement. With every new entitlement your app needs to be signed or re-signed with your apps provisioning profiles.

Updating iOS distribution certificates

Updating the app’s distribution certificate after it has been renewed or changed helps maintain the app’s distribution integrity and trustworthiness. This can be done without needing to rebuild the app locally or using your build servers. 

In the following we take a closer look at common use cases in which an app has to be re-signed with a new iOS distribution certificate.

Distribution certificate expiration

Distribution certificates have a limited validity period, typically one year. When a distribution certificate expires, any app that is distributed outside of the App Store can no longer be installed or updated on users’ devices. Re-signing with a new, valid distribution certificate ensures that the app remains distributable and usable.

Distribution certificate renewal

A few weeks before an iOS distribution certificate expires, the account owner of the iOS developer Account will get an email notification to renew the certificate. 

All builds that have been uploaded to the App Store and App Store Connect will continue to work after the certificate expires. Simply, the distribution certificate and provisioning profile will need to be renewed to upload the next build.
However, if you are distributing the application outside of the App Store, for example with an enterprise or ad-hoc profile, the app will no longer work. A new build with a newly generated certificate must be provided. 

In this case, it is better to renew the distribution certificate and issue a new build a few weeks before it expires, so that the client has time to update it and can continuously use the application without interruption.

Through email notifications, webhooks and the auto-update feature of the Updraft SDK, one can ensure that the client always has an up to date and functioning app.

When renewing a distribution certificate, the app must then be re-signed with the new distribution certificate. This ensures continuity in app distribution without interruption, maintaining the app’s integrity and trustworthiness. Do it before it’s too late.

Certificate revocation

If a certificate is compromised or revoked (e.g. due to security concerns), it's essential to re-sign the app with a new, secure certificate. This maintains the app's security and trust, preventing unauthorized or malicious access.

Changing developer teams

When transferring an app to a different Apple developer account, for example when you exchange your contractors, the app must be re-signed with the new team's distribution certificate. This ensures the app is correctly associated with the new Apple developer account, maintaining proper app ownership and distribution rights. 

Maintaining app updates

To continue providing updates for an app, e.g for testflight where the test-apps expire after 90 days, a new build with a valid distribution certificate must be submitted. This can be done either by taking the same build artefact and re-signing it, or by building and signing a new app version. This keeps the app functional and up-to-date for your users. Nobody will ask you anymore, that your app is not available or not installable. 

Re-signing an app with a new distribution certificate ensures that it remains functional, secure, and distributable, that it maintains the trust of users and that it complies with Apple's requirements.

Resolving provisioning or signing issues

Re-signing the app’s binary can resolve issues with the current provisioning profile or signing certificate. This approach allows you to quickly address signing and provisioning issues, ensuring the app remains available and reliable for users. You can apply new provisioning profiles without a complete rebuild of the app, saving time and effort.

Resolving provisioning or signing issues can address a variety of problems that can disrupt the development and distribution process of an iOS app. Here are some common issues and examples:

Expired provisioning profile

If a developer tries to install a new build on their device but the installation fails because the provisioning profile is no longer available, the provisioning profile may have expired. This prevents the app from being installed on devices. Re-signing the app with an updated provisioning profile will resolve this issue.

Mismatched certificates

After an Apple distribution certificate has been renewed, the app must also be updated with the new Apple distribution certificate and the corresponding new provisioning profiles. When re-signing, ensure that you use the correctly associated provisioning profile and distribution certificate to avoid any errors during the installation outside of the App Store or submission to App Store Connect. 

Revoked certificates

An iOS app previously signed with a certificate that was compromised and subsequently revoked will no longer be trusted by iOS devices. Re-signing the app with a new, valid certificate restores trust and functionality and the app can be installed again on end users’ devices. 

Adding or removing iOS devices

A developer adds new iOS test devices to their Apple Developer account but the app fails to install on these devices because the provisioning profile hasn't been updated. Re-signing the app with an updated profile that includes the new list of iOS devices resolves the issue and the app can be installed on the new devices. 

Changing display name

Before publishing the application, you can update the display name. The display name is the app-name displayed on the home screen. When using the Updraft re-signing service you can change the display name without having to ask a developer for help.

Changing version or build number

By modifying the version or build number of an app without a full rebuild, you can keep the version numbers accurate and reflective of updates. Apple requires each submission to TestFlight or the App Store to have a unique build number. This ensures that every submitted build is distinct and can be properly reviewed and managed by Apple’s systems.

iOS re-signing advantages

There are many different advantages to iOS re-signing. In particular, we see the following points as advantages of iOS re-signing in app development: 

• Ensuring consistency: Re-signing allows you to ensure that the exact same build will be provided, whether you're re-signing an ad-hoc build for the App Store or a build delivered by an app software agency working for a bigger company. You avoid the potential introduction of new bugs or issues that might occur during a rebuilding process.

• No need to rebuild: Re-signing eliminates the need to rebuild the app, saving time and resources in the development process.

• Security and convenience: As a company who outsources app development you don't need to give access to your distribution certificates or sensitive information to the app agency or to external developers, maintaining better control over your development assets.

• Streamlined process for agencies: For app agencies managing apps for multiple clients, re-signing allows them to handle app distribution without needing full access to client distribution certificates or development environments, simplifying the development process.

• Faster deployment: Re-signing is typically quicker than rebuilding the app, allowing for faster deployment, especially in time-sensitive situations

• Avoiding dependency issues: Rebuilding an app might require all dependencies and environments to be correctly set up, which can sometimes be challenging. Re-signing bypasses these potential issues by using an already compiled build.

• Easier management of multiple builds: If you manage multiple versions of an app for different environments (e.g., staging, production), re-signing allows you to maintain consistency across these environments without rebuilding each version.

Code signing done right

Properly managing app entitlements, provisioning profiles and distribution certificates is critical to ensuring an iOS app's functionality, security, and availability. Whether integrating new features, renewing certificates, or responding to security issues, regularly reviewing and updating these elements is essential. A well-structured process for re-signing the iOS app saves time, minimizes disruptions, and ensures that the app consistently meets current requirements while providing users with a secure and reliable experience when installing the application. 

With Updraft we offer a solution that can help you to sign iOS apps correctly without having to know much about how code signing works. Test our service and don’t hesitate to give us your feedback or suggestions for improvement -  we look forward to it!