50

My development certificate has expired. What is the correct method of renewing it? Do you revoke the expired certificate & submit a new Certificate Signing Request? Do provisioning profiles have to be recreated? Are there any side-effects of doing this?

9 Answers 9

33

With Xcode 5, following steps:

1) Remove old certificate from https://developer.apple.com

2) Open XCode - Preferences - Accounts - View Details, then click refresh icon in left-bottom

3) Xcode asks if you want to request a new certificate

Enjoy this simple work

4
  • 3
    Hi, these have expired for me now, but i didn't need to delete the original certificate(s) (as they were removed automaticaly, at least for me)
    – LetynSOFT
    Jan 22, 2014 at 9:59
  • Worked for me, after renewing the certificates, i had to refresh te certificates in the account.
    – Oritm
    Oct 3, 2014 at 10:27
  • Worked for me on Xcode 6.4 - I did not need step 1 though, 2 and 3 worked fine.
    – Ali Beadle
    Sep 22, 2015 at 9:39
  • Remove the old certificate from Keychain Access -> login -> My Certificates May 27, 2022 at 7:39
25

If the certificate is expired, you can not revoke it. You need to re-create it through the developer program portal.

Once you have your new certificate available, I am not sure if you need to create again the provisioning profiles associated to your previous certificate. I guess you must probably do this (unless the provisioning profiles just use the certificate subject and not the valid from/ to fieds).

To the best of my knowledge, there are no other side-effects.

9
  • 7
    Actually the only option available in the Program Portal was to revoke the certificate. So I revoked it, created a new CSR in Keychain Access and submitted it to create a new certificate. The Development Provisioning Profile then needed to be updated to associate it with the new certificate. To install I deleted the old provisioning profile from the XCode Organiser (and my devices) and dragged in the new .mobileprovision profile file, and double-clicked the developer_identity.cer certificate. This all worked and I can again run apps on my device.
    – Robin
    Feb 1, 2010 at 14:39
  • Everything you describe looks normal/familiar except the need to revoke it. From a technical point of view, you may only revoke a certificate which has not yet expired (e.g. if it has been compromised). Once expired, a certificate is no longer valid and wil simply not work at all. Anyway, as you told me, this is the only option available on the developer program portal. Thank you for sharing this. Feb 1, 2010 at 14:58
  • 1
    If it helps anyone else, I had this problem too however I also noticed that I had two certificates in my keychain... one expired one valid but both using the same name. Xcode appeared to be picking up the invalid one as soon as I deleted it everything worked again.
    – sradforth
    May 3, 2011 at 19:52
  • 1
    People do the steps a day after your provisioning / certificates expire. the process to renew is a bit easier and less confusing a day after expiration. At least in my experience.
    – Sam B
    Nov 17, 2012 at 14:47
  • @MassimoCafaro For renewing the certificates, Do I again have to submit the app at iTunes for approval Or its just revoke->new CSR-> create certificates only ? Jul 4, 2013 at 5:58
7

Don't know if this will help but I performed the following steps today to get my expired profile back on track.

NOTE: These steps are a day after my provisioning / certificates expired. I purposely did it a day after expiration. It makes the things much easier, in a weird way.

STEPS TO RENEW

1) login to itunes connect provisioning portal https://developer.apple.com/ios/manage/provisioningprofiles/viewDistributionProfiles.action

2) Click on certificates

3) Request New Certificate

4) Upload file CertificateSigningRequest.certSigningRequest from desktop folder. (if you had saved one from last time) For more info check this link

5) Hit submit

6) Launch your Xcode program

7) Click on Device

8) Click on Provisioning Profiles

9) Select your expired certificate and hit the renew button on the top.

10) Wait 2-5 minutes

11) Go back to https://developer.apple.com/ios/manage/provisioningprofiles and there should be a new distribution certificate

11a) Go to provisioning on the iTunes web and edit --> modify all your provisioning profiles and hit submit. Just modify any device or check box on them.

11b) After a few seconds your profiles will be renewed. (Hit refresh button on your browser)

12) download both development and distribution certificates. (no need to download provisioning certificates)

13) Save them in a new folder on desktop and double click on the dev and distribution certificates

14) This launches keychain. Delete old / expired keychains

15) Go back to Xcode under Provisioning Profiles and hit the Refresh button at the bottom

16) All should be working and nothing should be out to date or expired

6

Xcode 4.6 handles all of it for you - this process is now much easier than in the accepted answer.

See this link for details.

I believe the key to this process working is waiting until your certificate expires.

Here's how I did it in less than 60 seconds with Xcode 4.6:

1. Wait for your Developer certificate to expire
2. Open Xcode, open Organizer (cmd-shift-2)
3. Click on "Devices" at the top, then "Provisioning Profiles" under Library on the left
4. Click the Refresh button in the bottom right corner.
5. Xcode will detect you have no valid cert and ask if you'd like to submit a request for one - say yes.
3
  • 2
    I had to do one more thing in my case. Although my certificate was expired, Xcode didn't seem to recognize that at all. I went to apple developer portal online -> certificates -> all. "revoked" my expired certificate. Then when I hit refresh in xcode, it prompted if I want to submit a certificate request. Typical xcode nonsense.
    – Ara
    Apr 15, 2013 at 22:55
  • When I hit "renew", it shows the message "There are no current certificates on this team matching the provided certificate IDs". After checking this thread: stackoverflow.com/questions/16053710/… I realized that I have to delete existing certificates in Apple Developer Portal and then let Xcode 4 to handle the certificate re-issuing.
    – Wayne Liu
    May 16, 2013 at 13:08
  • One part of the Apple guide on App Distribution saved me a lot of time: Best Practises Aug 1, 2013 at 6:56
4

When my distribution profiles were within two days of expiring, I tried to extend them. I found that what was really expiring were the identity certificates in my keychain, to which all the profiles were tied. And I couldn't find any way of renewing the identity certificates; I had to delete my certificates from the keychain and create them from scratch, as described here:

https://developer.apple.com/library/ios/#qa/qa1618/_index.html

...Delete the certificate from your Keychain, then follow the "Obtaining your iPhone Development Certificate" or "Obtaining your iPhone Distribution Certificate" section in the iPhone Developer Program Portal User Guide to generate a new certificate

However, my problems didn't end there. Now I had a new certificate, and I was able to create a distribution profile as described here:

https://developer.apple.com/library/ios/#recipes/ProvisioningPortal_Recipes/CreatingaDistributionProvisioningProfile/CreatingaDistributionProvisioningProfile.html

However, I still couldn't create a distribution build (ad hoc or for the App Store), because Xcode complained that there were two distribution certificates in my keychain, and (it said) there Must Be Only One. But how could that be? I had deleted the expiring certificates. Yet sure enough, it was true: the expiring certificates that I had deleted had returned to my keychain!

In the end I figured out that it was Xcode itself that was somehow recreating the expiring certificates — presumably based on information inside the expiring development and distribution profiles that Xcode still contained. That's right, Xcode was creating a second certificate in my keychain, and then complaining that there were too many certificates in my keychain!!!!

So I deleted all the development and distribution profiles from Xcode, and then deleted the expiring certificates from my keychain again.

But that still didn't solve the problem, because Xcode proceeded to download all the profiles from the Portal again! And when it did so, it created the expiring certificates in my keychain again!!

So in the end I had to delete everything:

  1. I deleted all distribution and provisioning profiles from the Portal, so that Xcode couldn't download them again.

  2. I deleted all the distribution and provisioning profiles from Xcode.

  3. I also deleted all the distribution and provisioning profiles from my devices, just to be on the safe side.

  4. I deleted the expiring identity certificates from my Keychain, one last time.

At last I was left with a clean slate. So now I re-downloaded the distribution profile that I'd created at the Portal, and I was able to create a distribution build of my app and upload it to iTunes Connect.

My final problem was that now I couldn't build and run (develop) on my devices, because I'd deleted the expiring "team development profile". I couldn't find any way to make a new one at the Portal, and I couldn't find any way to ask for one in Xcode, but in the end I hit upon a lucky chance: I hooked one of my devices to the computer and asked Xcode to add it at the Portal, even though it had already been added to the Portal previously. This worked - it caused Xcode to ask the Portal for a new team development profile, and at last I was fully back in business. I was able to develop on my devices with the team development profile, and I was able to create distribution profiles and download them and build with them for Ad Hoc or App Store builds.

So what I learned from this adventure is: When your certificates expire, delete everything (all certificates and profiles) and start over from scratch.

1

With Xcode 4.4.1 the organiser takes care of renewing certificates.

In my case I had to do the following steps:

1) Open Xcode and launch the Organizer (Window-->Organizer)

2) Go to the Device tab and under the Teams section select your developer identity (If your iOS Development certificate has expired you should not see it in the list)

3) Hit refresh on the bottom right

4) Xcode asks if you want to request a new certificate

5) Approve the request and complete the procedure (Export the certificate if you develop on other Macs)

6) Close Xcode

7) Remove the expired certificate from keychain (I suggest to save it before deleting it anyway, even if unnecessary for the following steps - it's always good to keep backups also of expired certificates)

8) Open Xcode and for each Xcode project choose the new Code signing identity in the Build settings of your Target.

9) Clean up the project (Product-->Clean)

10) Compile and deploy.

Pretty straight-forward.

1
  • 1
    I did not find this to be true. The developer identity under Teams is not selectable, and refreshing does not cause Xcode to ask if I want a new certificate (we just download the same expiring certificate).
    – matt
    Nov 15, 2012 at 16:32
0

In my experience I started by deleting the expired certificate. Then I did the whole Request a Certificate from a Certificate Authority process:

enter image description here

After that was done I went into iOS Provisioning Portal--> Provisioning and clicked Modify for the profile that was giving me trouble. I then selected my device and submitted. Lastly I downloaded the new profile and added it to the Xcode Project.

NB: This is for Xcode 4.3 on Lion.

1
  • What CA email address did you use? Any chance I could trouble you to explain the fields in the dialog when requesting a cert?
    – nmr
    Sep 6, 2012 at 19:34
0

I've just renewed my expired certificate and provisioning profile using Xcode 4.3.2. The Apple docs say to 'Use [the device] for Development' in the Xcode Organiser - which I'd done originally but that button doesn't show up anymore.

I tried deleting the existing profiles but that didn't help. I eventually noticed the 'Add to Portal' button in the bottom bar of Organiser. Clicked on that and after following the prompts it did the trick - it created a new certificate and provisioning profile.

Happy days - well almost - Xcode itself was still moaning about a duplicate certificate in Keychain Access. Deleted the expired one (and any others that were expired) and Xcode is now happy (I had to change a file to get Xcode to actually try to re-build though).


For XCode 5 I followed Baryon Lee's post, except that I didn't need to remove the old certificate first (I tried up up-vote you Baryon but I'm a couple of reputation points short :-( ). I needed to add my details onto the Accounts page first.

2
  • It is now 'add to member center' - thanks, much prefer this way of doing it.
    – user234736
    Mar 6, 2014 at 6:11
  • Had to restart xcode after re-adding the device to member center. With this minor quirk, what you described also works in Xcode 5.01.
    – user234736
    Mar 6, 2014 at 6:21
0

See also this post if the provisioning profiles silently fail to renew after recreating the certificates using Baryon Lees answer for Xcode 5

renewing provisioning profile and certificates

You have to go edit each profile and check the certificate box and generate but don't download.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.