Fix: No iOS Distribution Signing Certificate Found in Xcode

Why this happens

Code signing on Apple platforms relies on public-key cryptography. To sign an application for distribution (Ad Hoc, TestFlight, or the App Store), Xcode requires both halves of a cryptographic identity: the public certificate (.cer) registered with Apple and the matching private key stored locally in your macOS Keychain.

When Xcode displays the error No "iOS Distribution" signing certificate matching team ID "..." with a private key was found, Xcode has evaluated your installed certificates or the provisioning profile selected for the target, but it cannot find the corresponding private key on your Mac.

This frequently occurs when:

• A client or teammate downloaded the public .cer file from developer.apple.com and sent it to you. That file contains only the public key.
• A .p12 file was exported from Keychain Access on another Mac, but the user exported only the certificate row rather than expanding it to include the nested private key.
• The .p12 was imported into the System or an unintended custom keychain instead of the default login keychain where Xcode searches for signing credentials.
• Your project uses manual code signing, and Build Settings specifies an iOS Distribution identity for a configuration that conflicts with the installed certificates.

How to fix it

1. Export the certificate and private key together as a .p12

If the certificate was originally created on another developer’s Mac, the private key resides in that Mac’s Keychain Access. Installing only the .cer file on your machine will never work.

Ask the person who created the certificate to export the full identity:

1. Open Keychain Access on the original Mac.
2. In the sidebar, select the login keychain and click My Certificates.
3. Locate the certificate named Apple Distribution: [Team Name] or iPhone Distribution: [Team Name].
4. Click the small disclosure triangle to the left of the certificate name. Verify that a private key appears indented beneath it.
5. Select both the certificate and the private key (or select the parent certificate with the arrow expanded).
6. Right-click and choose Export 2 items… (or Export “[Certificate Name]”…).
7. Set the file format to Personal Information Exchange (.p12).
8. Set a secure password when prompted.

Transfer that .p12 file to your Mac. Double-click it to open Keychain Access, enter the password, and ensure the Keychain dropdown is set to login before clicking Add.

2. Generate a new distribution certificate on your Mac

If you have Member, Admin, or Account Holder access to the Apple Developer account, you do not need to hunt down the old private key. You can generate a fresh distribution certificate directly from your machine.

In Xcode:

1. Go to Xcode > Settings… (or press Cmd + ,).
2. Select the Accounts tab.
3. Select your Apple ID in the left pane and your Team in the right pane.
4. Click Manage Certificates… in the lower right corner.
5. Click the + button in the lower left of the sheet and select Apple Distribution (or iOS Distribution on older Xcode versions).
6. Click Done.

Xcode creates a private key in your local login keychain, generates a Certificate Signing Request (CSR), uploads it to Apple, and installs the signed certificate back into your keychain. Both public and private keys will now be present.

Note: If you have already reached the maximum number of active distribution certificates allowed for your team (typically 2 or 3 per account type), you must revoke an unused certificate on developer.apple.com under Certificates, Identifiers & Profiles before creating a new one.

3. Check Keychain Access for orphaned or misplaced keys

Sometimes the private key exists on your Mac, but Xcode cannot access it because it is stored in the wrong keychain or detached from its certificate:

1. Open Keychain Access (/Applications/Utilities/Keychain Access.app).
2. In the left sidebar, click login.
3. Click the My Certificates category.
4. Check whether your Distribution certificate has a disclosure triangle. If there is no triangle to expand, your keychain holds only the public certificate.
5. Select Keys under the Category sidebar. Look for an orphaned private key whose creation date matches the certificate. If found, drag both items into the login keychain under the same tab.
6. Select the private key, right-click, and choose Get Info.
7. Switch to the Access Control tab. Ensure Confirm before allowing access is selected and that Xcode is listed, or select Allow all applications to access this item temporarily to test if permissions were blocking Xcode.

4. Verify Code Signing Identity in Build Settings

If you use manual signing rather than Xcode’s automatic signing, an incorrect build setting can cause Xcode to search for an identity you do not intend to use:

1. In Xcode, select your project in the Project Navigator, then select your target.
2. Navigate to the Build Settings tab.
3. Search for Code Signing Identity.
4. Expand the setting to see your configurations (e.g., Debug, Release).
5. For the Release configuration (used during Archive), ensure the value is set to Apple Distribution or iOS Distribution, not an explicit certificate string that no longer exists.
6. Search for Development Team and ensure the Team ID matches the team that issued your distribution certificate.

How to prevent it

• Enable Automatically manage signing: Whenever possible, check Automatically manage signing under your target’s Signing & Capabilities tab. Xcode automatically generates and manages local signing identities.
• Standardize team onboarding: Export team certificates and private keys as .p12 bundles into a secure vault (such as a password manager or encrypted drive) when an account is set up, rather than relying on individual developer machines.
• Never download raw .cer files across machines: Downloading a .cer file from the Apple Developer portal only works on the exact Mac that generated the Certificate Signing Request (CSR).

FAQ

Will revoking an existing distribution certificate break apps already in the App Store?

No. Revoking an iOS Distribution certificate does not affect live App Store applications or existing enterprise installations signed with that certificate. It only prevents you from signing new updates or uploads until a new certificate and provisioning profile are generated.

Can I extract the private key from a mobileprovision profile?

No. Provisioning profiles (.mobileprovision) contain the application identifiers, entitlements, devices, and copies of the public certificates allowed to sign the app. They never contain private keys.

What is the difference between an “iOS Distribution” and an “Apple Distribution” certificate?

Starting with Xcode 11, Apple introduced unified “Apple Development” and “Apple Distribution” certificates that work across iOS, iPadOS, macOS, watchOS, and tvOS. Older projects may still reference legacy “iOS Distribution” identities, but modern Xcode versions treat “Apple Distribution” as the direct replacement.