I am part of a development team with many apps spanning multiple business units and iOS teams. We are having a lot of trouble right now managing distribution certificates. Apple lets you have 3 distrution certificates on one development account, but there is no way to name the certificates uniquely, so they all look the same. The only identifying information on the different certificates is the date on which it was generated.
Apple, why can't we rename these distribution certificates so that we can manage them better???
We need the ability to allow multiple build boxes to archive and submit to iTunesConnect for TestFlight or App Store releases.
We are finding ourselves accidentally revoking each other's distribution certificates all of the time, and even worse making it impossible for beta users to install from TestFlight if the certificate has been revoked.
Apple, why do you disallow installation of TestFlight builds if the "developer's certificate is no longer valid"??? This is crazy. You don't do this when an app has been published in the App Store. Why should TestFlight be any different??? Why punish beta users because the developers have accidentallly revoked a certificate???
We also think that it is Xcode's "Reset" or "Fix it" buttons that are doing the certificate revoking and causing so much trouble.
So how are other large development organizations handling this better? We've got a big team, but not nearly as big as many others that are out there.
We've tried assigning different dev teams a certificate generated on a particular date and asking them to only use that date and never revoke anyone elses' certificate. We've also tried exporting certificates from a single box. But it seams that no matter what we do something happens that causes the certificates to become revoked. It seems that Xcode itself is causing this.
Have you ever tried fastlane
https://fastlane.tools/
also you can try match (one of the tools in fastlane) that could help you to sync with all your devs the certificates
https://github.com/fastlane/match
also with fastlane tools you can automatically submit to appstore and testflight ipas
HTH
We adopted the following approach and have been conflict free for a few months now! We first removed the 'admin' role from most of our development team members so that they couldn't so easily revoke certificates by clicking on a 'fix' button. Then we generated a single distribution certificate that we share amongst the team. We also encourage builds being made on a shared build box when possible.
I am enrolled in the Apple Developer Program as an Organization.
As you know you are only allowed to create a maximum of 2 development
certificates and 2 distribution certificates.
Problem:
I have 3 developers working on the App. So, they keep deleting each others certificate to be able to create provisioning profiles. Some time it gets messy and they delete push notification certificate and then we had to regenerate the certificates to create pem files and upload it to server again cause server stops sending notifications successfully.
How can I manage this in a clean way?
I tried to invite them and add them as developers in apple member center. that didn't work cause developer can't do anything. But, with admin role they still see each other certificates. but at least they can create more than 2 certificates.
And I added them as admins in the iTunes connect too. not doing this caused a problem. but I am not sure. they not been able to upload a version from their Xcode with their accounts cause its like they don't have permission for upload. "upload fails after they pick the team and provisioning profile with their account".
Anything wrong with what I said? Is that how apple wants us to handle it? or there is another way?
No magic trick here. You cannot have more than 2 Distribution certificates and your developer will have to manually share those and the associated private keys. I believe this is legacy as a while ago only the Team Agent was authorized to manage the Distribution certificate.
Have a look at tools like https://github.com/fastlane/match which automates the sharing process and solved the issue for my agency.
Nicolas
Xcode as of 6.3 is no longer allowing me to automatically perform device provisioning for a client. Has anyone else experienced this issue? I found no results when searching for this on Google...
This client has their own bundle ID and it's possible they also have their own provisioning profile for this device. So maybe Apple is matching up the bundle ID irrespective of the developer account being used for provisioning.
I was able to address the issue by modifying the app's bundle ID and manually going through the provisioning process, but I'm guessing this issue is extremely rare, so I'm not sure if this post will be of use to anyone.
When I am create new certificate from my Xcode 9.2 the error was appear
"You already have a current iOS Distribution certificate or a pending certificate request".
Just 2 step for fix this error.
Remove old certificate from developer.apple.com
Create new certificate from Xcode or developer.apple.com
My problem has been solved (I am using Xcode 9.2).
I just found that if I remove my account from Xcode, and then sign in again, it solved the issue. I did revoke my existing certificates and request new ones though as part of that process. I didn't import an existing profile.
My team has maxed out on release certificates, because apparently there is a quota.
We had to delete one of the existing release certificates.
This issue is actually more common than you think.
Some Solutions:
I usually find that opening Xcode's settings and signing out of my account and the signing in again resolves most of those issues.
You may have an older mac that already used up that one allotted development certificate. In that case you'll want to export the developer profile from that machine. If you no longer have access to that machine, it may be time to invalidate that certificate and simply request a new one.
Another option may be to double check your build settings in your project and ensure that it's looking for the right certificate. It's fairly common in my experience for these settings to make decisions on their own, and confirming that they're what you expect may help.
Background:
When dealing with provisioning, it's really easy to get caught up with the frustration of all of the steps you need to go through. The first thing to note is if the error you see is talking about a "Certificate" or a "Profile." In your case, it's a certificate. Good.
Certificates differ from provisioning profiles in a few ways. Certificates are usually only generated twice: once for development, and once for distribution. (Exceptions to this rule are if you decide to add support for some of the special features like push notification or for generating passbook passes on a server.)
The process for generating certificates is also a little more bureaucratic than profiles. You request a certificate from Apple's Member Center. You generate a provisioning profile.
The reason for the word request vs generate is because both Apple and your iOS team's admin need to approve certificate requests. This is because certificates identify you as part of your iOS developer team, and offer all the powers associated with that.
For the sake of completeness, I'll add that provisioning profiles are generated based on that certificate, and really only tell iOS what environment your app is meant to run in. (On any device via the store, specific devices, etc.)
Now, the important part for you is the request business. Most people don't pay much attention to this terminology, since indie developers and small teams (where the developers are admins) don't require developers to ask for permission.
Your error is talking about a previously generated certificate or request. You can only have one development certificate per developer. You either have one, or you've requested one and someone has to approve.
That's what's happening here.
This process is made simple with Xcode 8.3 and 9. Just delete one of your old certifcates in the "validate" interface and click the plus button to request new one, Xcode will request for you and add it in keychain. in my case, maximum number was reached, so I deleted one which was lost in a old Mac and created new one.
This error may also be occur if you reach your distribution certificate limit. After creating 3 iOS Distribution Certificates in an account, the following error message will be displayed when you try to create 4th one: "You already have a current Distribution certificate or a pending certificate request."
Open this link
https://developer.apple.com/account/resources/certificates/add
Press + icon in front of Certificate
Check Apple Distribution section if its show the red text as shown in image then you should revoke you existing certificates to generate new one because you have reached you limit.
Just 2 step for fix this error.
Remove old certificate from developer.apple.com
Create new certificate from Xcode or developer.apple.com
Delete old developer certificate from https://developer.apple.com/account/ios/certificate/ and try to create developer certificate from xcode
1) Remove old certificate from apple developer account.
2) Go to the 'Xcode' 3) Select 'Preferences' option and then Select the 'Account' Tab
3) Select apple id from left side and click on 'Manage Certificate'.
4) Click on '+' (add certificate) button.
5) Add 'Apple Distribution' Certificate.
Unfortunately, only a macbook restart resolved this for me.
Creating another Distribution certificate was not an option, because it had already reached the max. number of certificates.
I manually added an existing one (incl. its private key) to the Keychain …and still Xcode said "Not in Keychain". I then tried to trigger a refresh of the Xcode listing by removing & adding my developer account to Xcode, but that didn't work — neither did restarting Xcode.
So, when all else fails, you try to reboot your system.
When you have three active distribution certificates that were created on distinct machines, you'll see this issue. You can either ask for the private key of a previously made one or simply revoke any of them and make your own.
Suddenly I started getting this from Testflight when uploading a new build of an app:
This build is signed with a Developer certificate, it can only be installed by devices with the Developer feature enabled. We recommend signing with a distribution provisioning profile for best results.
And my users have problems installing the app. I've gone over the project settings again and again, but everything looks right.
I've set the team provisioning profile to be the provisioning profile for both debug and release, I've even changed to a different team, but still the same problem.
Am I looking in the wrong place here?
I just came across this exact same issue. It looks like TestFlight have added a new check and are flagging developer provisioning profiles when they didn't in the past. Take a read of this (posted yesterday):
Testflight article
I've just uploaded a build to test flight using my normal approach to signing (with a developer certificate), ignored the testflight message, and distributed to my test users. Seemed to work OK.
In years gone by we found that we could only have 1 distribution certificate per logged on user so we created as many accounts as was need, 3 in our case, 1 for each developer program and logged onto the mac using the required account.
So anytime an app was developed and need to be distributed in-house I would log onto the mac using the enterprise account and archive and distribute for in-house and sent the resulting .ipa file and the provisioning profile to the users.
I have now discovered I can have multiple distribution certificates on the mac and am trying to see if I can distribute via in-house logged on to the mac as me and use my own profile or the team profile that link to the enterprise developer program.
The app build ok and generates the ipa file and I can install using iTunes but I get a faded icon on the iphone and when tapped it says installing but never does?
So, my two part question is:
a) is it possible to distribute in-house using my enterprise linked account logged on as me and using my profile or team profile
b) I read you do not need to give the user the profile, but I have always done this as was the requirement when I first learned to do this?
Thanks
a) Yes. I have 10 or so certificates (dev & dist) on my computer for various clients. I keep them in separate keychains for peace of mind. When it comes to time distribute your in-house binary, you archive in Xcode then hit the Distribute… button in the Xcode organizer, choosing the correct Enterprise profile.
b) This is no longer necessary as the Distribute… step mentioned above embeds the profile in the app. Things are much easier than they used to be.
NB: I avoid wildcard provisioning profiles as they can cause heartache, even in simpler situations than yours (e.g. if Xcode chooses a wildcard Ad Hoc profile during Archive, then your entitlements may be wrong once you Distribute), so for this reason I recommend you always use explicit profiles.