Escape the iOS provisioning hell

by Jannik on 10/7/2013

This post is a more complete writeup of a pretty popular answer I gave on stackoverflow about iOS developer certificates.

A lot of people seem to have problems with developer certificates for their iOS apps. Us included.

If you’ve released an iOS app before chances are that you ran into this error:

Code sign error: No unexpired provisioning profiles found that contain any of the keychain’s signing certificates

The original question

Here is the question the user Greg
asked on stackoverflow:

I have seen a few other questions that addressed this topic but none like mine. Yesterday I innocently added a
device to the list of devices. I am under the impression that once you add a device, it will now be linked to the
provisioning profile. However, I believe it was not linked to one of my distribution profiles. So I went into edit
the profile, clicked the checkmark next to the device, and hit submit. This is where the problems began. I notice
two things: I recently renewed my certificate/provisioning profiles about a week ago. Now, it thinks I renewed my
provisioning profile yesterday ( or at least it says so in the organizer ). Also, when I try to build any project I
get the awful “No unexpired provisioning profiles found that contain any of the keychain’s signing certificates”. In
the build settings my signing identity shows up under Identities without provisioning profiles. I have read horror
stories of people having to tear everything down and rebuild and I hope I don’t have to do that here..

The answer

This worked for us and for many stackoverflow members.

  1. in the xcode organizer:
    – delete all provisioning profiles
  2. in the mac os x keychain:

    – delete all iOS dev certificates

  3. go to

    – log into the member center

    – revoke all certificates (edit: some redditors pointed out that this isn’t a good idea if you’re working in a bigger team. If that’s the case try just deleting expired ones.)

  4. go back to the xcode organizer:

    – click refresh (bottom right) under the provisioning profiles tab and login
    – List item
    – on the popups click the positive button

  5. in your xcode project go to the “build settings” tab

    – under code signing pick the dev. and distr. identities
    – if they are not there or not valid go to and navigate to “provisioning” if they are
    invalid just click modify and save them again

  6. go back to the xcode organizer:

    – hit refresh again (bottom right)

Discuss this post on stackoverflow
Discuss this post on reddit

There are 4 comments in this article:

  1. 01/20/2014Bina says:

    Step 3 is dangerous
    you can never revoke a certificate if it has been used for publishing

  2. 02/17/2014Belraim says:


    tried to solve this problem for about 4 days now.

  3. 03/20/2014Julie Poon says:

    I have an app for in-house distribution only. The app is is publish two years ago and we revoke many certificate last year in order to renew the certificate.

    This year I found that I can update the certificate. fine. I refresh the old certificate, create a new certificate and put them all in the xcode. I sign the app with the new certificate and distribute to users before the licence expire. Everything seems find but the app can’t be download after the old certificate expire! I can install the app using my iPad, but some people response that they can’t download. after few days of investigation, only to find that the Xcode use the expired certificate to sign the app! (what the hxll). I tried remove the expired certificate and refresh with the new ones but the problem is not solved. I got a nightmare….

  4. 05/14/2014Ingvar says:

    Thanks. This is really hell. Think I have revoked all and created new four times now. Why does it need to be so hard to do things that should really “just work.”..

Write a comment: