Fix: Valid Signing Identity Matching Profile Not Found in Keychain

Why this happens

Code signing on Apple platforms requires a two-part cryptographic pair: a public certificate issued by Apple and a private key stored securely in your macOS Keychain. Together, these form what Xcode calls a Signing Identity.

When Xcode presents the error A valid signing identity matching this profile could not be found in your keychain, it means Xcode found the provisioning profile you selected, inspected the certificates embedded inside that profile, and searched your local Keychains for a matching pair. The lookup fails in one of three scenarios:

1. The private key is missing. If you downloaded your .cer file directly from the Apple Developer portal onto a new Mac or after a clean OS install, you only downloaded the public portion. The private key was generated on the Mac that created the original Certificate Signing Request (CSR) and remains there until exported.
2. The certificate was revoked or renewed. If you or a team admin revoked the certificate in Apple Developer portal, any older provisioning profiles tied to that certificate become invalid.
3. Intermediate authority missing or expired. If macOS lacks a valid Apple Worldwide Developer Relations (WWDR) intermediate certificate, Keychain cannot establish the trust chain for your developer certificate, causing it to display as untrusted or invalid.

How to fix it

1. Export the Private Key from Your Original Mac (.p12)

If you work across multiple computers (e.g., transitioning from a laptop to an iMac, or setting up a new build machine), you cannot simply download the certificate from Apple Developer. You must transfer the private key.

1. On the original Mac where the certificate was created, open Keychain Access (/Applications/Utilities/Keychain Access.app).
2. Select the login keychain on the left sidebar and navigate to the My Certificates tab.
3. Find your active Apple Development or Apple Distribution certificate. Click the disclosure triangle next to it. You must see a private key nested underneath.
4. Select both the certificate and its nested private key (or right-click the certificate directly).
5. Choose Export “[Certificate Name]”… from the context menu.
6. Select the file format Personal Information Exchange (.p12).
7. Enter a password to protect the file and save it.
8. Transfer the .p12 file to your new Mac and double-click it. Enter the password you chose, and ensure it imports into the login keychain.
9. Return to Xcode and rebuild your project.

2. Create a Fresh Certificate and Regenerate the Profile

If you formatted your Mac, no longer have access to the original machine, or lost the private key, you cannot recover it. You must generate a new key pair and update your provisioning profile.

Step A: Generate a new Certificate Signing Request (CSR)

1. Open Keychain Access on your current Mac.
2. From the menu bar, choose Keychain Access > Certificate Assistant > Request a Certificate From a Certificate Authority…
3. Enter your email address and common name.
4. Leave the CA Email field empty and select Saved to disk.
5. Click Continue and save the CertificateSigningRequest.certSigningRequest file.

Step B: Issue a new certificate in Apple Developer

1. Log in to developer.apple.com and navigate to Certificates, Identifiers & Profiles.
2. Under Certificates, locate the old, unusable certificate and click Revoke (if you have reached the maximum number of active certificates allowed for your account).
3. Click the + (plus) button to create a new certificate.
4. Select Apple Development or Apple Distribution (depending on your build target) and click Continue.
5. Upload the .certSigningRequest file created in Step A.
6. Click Generate, download the .cer file, and double-click it to install it into Keychain Access.

Step C: Update and re-download your provisioning profile

1. In the developer portal, click Profiles on the left menu.
2. Select your profile and click Edit.
3. Check the box next to your newly created certificate under the Certificates list.
4. Click Save and download the updated .mobileprovision file.
5. Drag and drop the downloaded file onto the Xcode dock icon or into your target’s Signing & Capabilities tab.

3. Clear Stale Provisioning Profiles in Xcode

Xcode caches older provisioning profiles locally. If a stale profile shares the same name or bundle ID as a newly renewed one, Xcode might attempt to sign using the old profile.

To clean up stale profiles:

1. Quit Xcode completely.
2. Open Terminal and remove the cached profiles directory:
   bash
rm -rf ~/Library/MobileDevice/Provisioning\ Profiles/*
3. Re-open Xcode.
4. Open Settings (or Preferences) > Accounts.
5. Select your Apple ID, select your team, and click Download Manual Profiles.

4. Install the Updated Apple WWDR Intermediate Certificate

If Keychain reports your developer certificate as Certificate is not trusted or This certificate has an invalid authority, your system is missing the root or intermediate certificate.

1. Open Keychain Access and search for Apple Worldwide Developer Relations.
2. If you see expired certificates marked with a red circle or “Expired”, delete the expired copy.
3. Visit Apple PKI (pki.apple.com).
4. Download the current Worldwide Developer Relations – G3 (and G4/G6 depending on what your distribution type requires).
5. Double-click the downloaded .cer files to install them into your System or login keychain.
6. Verify that your personal Apple Development/Distribution certificates now show a green checkmark stating This certificate is valid.

5. Enable Automatically Manage Signing (Recommended)

Unless your project specifically requires rigid manual profile administration for enterprise or custom continuous integration (CI) workflows, use modern automatic signing:

1. In Xcode, select your project in the Project Navigator, then choose your app target.
2. Navigate to the Signing & Capabilities tab.
3. Check the box labeled Automatically manage signing.
4. Select your Team from the dropdown menu.

Xcode handles CSR generation, private key synchronization, certificate creation, and profile provisioning automatically through the Apple Developer API.

How to prevent it

• Back up development identities: Whenever you generate a new signing certificate, immediately export both the certificate and private key as an encrypted .p12 archive and store it in an encrypted password manager or secure vault.
• Avoid manual profile downloads: Rely on Xcode’s Automatically manage signing for standard development; it detects missing identities and creates fresh development certificates automatically.
• Do not delete login keychain keys: Avoid running generic cleanup utilities that clear system or login keychains without verifying whether developer private keys are stored inside.
• Keep CI machines isolated: Use dedicated match/fastlane repositories or explicit machine-provisioned .p12 files with predefined environment variables rather than copying user keychains manually.

FAQ

Can I recover my private key if I formatted my Mac?

No. Private keys are generated locally on the machine that requested the certificate and are never sent to Apple. If you lose the private key and have no backup, you must revoke the certificate on the developer portal and issue a new one using a fresh Certificate Signing Request.

Does revoking a developer certificate break my live App Store apps?

No. Revoking an iOS Development or iOS Distribution certificate does not affect apps that are already approved and live on the App Store. It only affects your ability to create new builds, run local debug builds, or submit updates until a new certificate is generated.

Why does Keychain show my certificate in “System” instead of “login”?

Developer certificates and their corresponding private keys should always reside in the login keychain. If an identity is placed in the System keychain, Xcode may fail to access the private key during command-line or target code signing tasks without elevated root privileges.