Code signing and provisioning profiles

Platform & distribution Mid-level Swift 5.0+ iOS 17+ Reviewed By Alok Singh

Pick the fix

Which certificate and profile sign a TestFlight build?

Options
Hint 1 of 1

TestFlight goes through App Store Connect.

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A An Apple Distribution certificate with an App Store provisioning profile

Correct. TestFlight uses App Store distribution signing.

Why not the others?
  • B An Apple Development certificate with a development profile. That's for running on registered devices from Xcode.
  • C A Developer ID certificate. Developer ID is for Mac apps distributed outside the App Store.
  • D An ad hoc profile. Ad hoc is for a fixed list of registered devices, not TestFlight.

30-second answer

Code signing proves who built the app and that it wasn't changed. A certificate (Apple Development for running on devices, Apple Distribution for TestFlight and the App Store) holds your signing identity. A provisioning profile ties together the App ID, the certificate, entitlements such as push or App Groups, and, for development and ad hoc, the allowed devices. Automatic signing in Xcode manages most of this.

Practise saying it · 45 s. No recording, just a timer

Explain signing and profiles.

Say your answer out loud, then check which of these points you covered:

  • Certificates prove identity
  • Profiles bind App ID, entitlements, devices
  • Development vs distribution

Deep dive

Entitlements in the profile must match the capabilities in the app.

Ad hoc profiles list device UDIDs; App Store profiles don't.

CI often uses an App Store Connect API key with automatic signing, or a managed tool.

Expired certificates block new builds, not installed App Store apps.

Common mistakes

  • Sharing private keys by email.
  • Entitlement mismatches after adding a capability.

Senior take & follow-ups

Seniors explain what each piece proves and debug mismatches from the profile.

Follow-up questions

Think of your answer first, then open the hint.

  1. Why does a push build fail to register?

    Show hint

    The profile lacks the push entitlement or uses the wrong environment.

  2. What does a profile contain?

    Show hint

    App ID, certificates, entitlements, and devices for development or ad hoc.

Related questions

Try it in a free tool

Suggest a fix if something here is wrong or out of date.