Fix: Provisioning Profile Doesn’t Include Signing Certificate in Xcode

Why this happens

A provisioning profile (.mobileprovision) acts as a cryptographically signed manifest from Apple. Among other metadata—such as app entitlements, bundle identifiers, and allowed test device UDIDs—it contains an array of authorized signing certificates (DeveloperCertificates).

When Xcode builds your project, it examines the certificate selected under Code Signing Identity in your build settings, matches it with an installed certificate in Keychain Access, and verifies that the certificate’s public key hash is listed inside the designated provisioning profile. If the certificate chosen for compilation is absent from the profile’s embedded certificate list, Xcode halts the build with the error:

Provisioning profile "[Profile Name]" doesn't include signing certificate "[Certificate Name]"

This mismatch commonly occurs when:

• The target’s build configuration specifies an Apple Distribution certificate for a debug build, but the selected profile is an Apple Development provisioning profile (or vice versa).
• A team certificate expired or was revoked, and the newly created certificate has not yet been checked and linked to the provisioning profile on the Apple Developer portal.
• Multiple team members work on the same project using manual signing, but the provisioning profile only includes certificates belonging to some of the developers.

How to fix it

1. Switch to Automatic Signing

For most development and CI workflows, enabling automatic signing allows Xcode to reconcile profiles and certificates automatically.

1. In Xcode’s Project Navigator, select your project root, then select your target under Targets.
2. Click the Signing & Capabilities tab.
3. Check the box labeled Automatically manage signing.
4. Select your Team from the dropdown menu.

Xcode will contact the Apple Developer account, create or refresh the required development certificate, and generate a managed profile that includes your local signing identity.

2. Align Code Signing Identities in Build Settings

If you use manual signing (common for enterprise distributions or locked CI/CD pipelines), verify that your build settings are not requesting a distribution certificate for debug configurations.

1. Select your target and navigate to the Build Settings tab.
2. Ensure the filter is set to All and Combined.
3. Search for Code Signing Identity.
4. Expand the Code Signing Identity hierarchy:
   – Set Debug to Apple Development (or iOS Developer).
   – Set Release to Apple Distribution (or iPhone Distribution).
5. Search for Provisioning Profile and ensure each configuration references the matching profile type:
   – Debug should point to a Development profile.
   – Release should point to an App Store, Ad Hoc, or Enterprise profile.

If your debug target attempts to sign with an Apple Distribution identity using a development provisioning profile, Xcode throws this error immediately.

3. Add Your Certificate to the Provisioning Profile

If your team uses manual provisioning profiles, the profile itself must be regenerated to include your public certificate.

1. Log in to your account at developer.apple.com and go to Certificates, Identifiers & Profiles.
2. Under Profiles, select the provisioning profile assigned to your target and click Edit.
3. In the Certificates section, verify whether your certificate is checked. If it is unchecked, select it. If multiple developers share this profile, ensure each developer’s active development certificate is selected.
4. Click Save.
5. Download the updated .mobileprovision file.
6. Double-click the downloaded file or drag it onto the Xcode icon in the Dock to install it.
7. Return to Xcode’s Signing & Capabilities tab and re-select the updated provisioning profile under Import Profile or the Provisioning Profile dropdown.

4. Clean Stale Provisioning Profiles and Keychain Entries

Xcode sometimes caches outdated provisioning profiles that share the same bundle ID or name, preventing the newer profile from being used.

1. Quit Xcode.
2. Open Terminal and remove cached provisioning profiles:
   bash
rm -rf ~/Library/MobileDevice/Provisioning\ Profiles/*
3. Open Keychain Access on your Mac.
4. Select login under Default Keychains and My Certificates under Category.
5. Look for duplicate, expired, or untrusted Apple certificates (such as expired “Apple Worldwide Developer Relations Standard Certification Authority” intermediate certificates).
6. Delete any expired certificates that share the name of your active signing identity.
7. Reopen Xcode, build the project, and allow Xcode to download or re-import the current profile.

How to prevent it

• Rely on Automatic Signing when possible: Automatic signing eliminates manual syncing between developer certificates and portal profiles.
• Regenerate profiles after adding certificates: Whenever a developer on your team creates a new signing certificate, update shared manual provisioning profiles immediately.
• Avoid hardcoding certificate names: In Build Settings, use generic identities such as Apple Development or Apple Distribution rather than specific certificate names or hashes.
• Verify intermediate certificates: Ensure the latest Apple Worldwide Developer Relations (WWDR) intermediate certificates are installed and trusted in Keychain Access.

FAQ

Can I inspect which certificates are inside my provisioning profile?

Yes. Open Terminal and run security cms -D -i /path/to/profile.mobileprovision. Look for the DeveloperCertificates key to see the array of base64-encoded X.509 certificates included in that profile.

Why does this error appear after creating a new Mac user account?

When you create a new Mac user or switch machines, the private key corresponding to the existing certificate in the provisioning profile is not present in your new Keychain. You must either export the certificate with its private key (.p12) from the old Mac or generate a new certificate and add it to the profile.

Will enabling automatic signing modify my production certificates?

No. Automatic signing creates separate development and distribution certificates managed by Xcode. It will not revoke or alter existing manually created certificates unless an administrator explicitly revokes them in the Apple Developer portal.