Certificates, profiles and entitlements: how is a build signed?

Middle PRO

Essence

For iOS to launch an app, the binary must be signed and the signature must be allowed by a profile. A signature is made of three parts, and almost every "won't install" or "won't sign" error is a mismatch between them.

• Certificate + private key (signing identity) — "who signed it". Apple Development for debugging on devices, Apple Distribution for TestFlight, the App Store and Ad Hoc. The private key lives in the keychain of whoever created the certificate request; without the key the certificate is useless.
• Provisioning profile — "what is allowed and where": the App ID (bundle id), the certificates allowed to sign, device UDIDs for development and ad hoc, and the allowed entitlements. The profile is signed by Apple and embedded in the .app as embedded.mobileprovision.
• Entitlements — "which rights the app asks for": push (aps-environment), App Groups, Keychain sharing, Associated Domains, iCloud, HealthKit. It's a plist signed together with the code. Every key must be allowed by the profile, otherwise installation or the API call fails.