Fix: Valid Signing Identity Not Found in Xcode on a New Mac

Why this happens

Code signing on Apple platforms requires three pieces working together: a provisioning profile, a signing certificate, and the matching private key. While provisioning profiles and .cer certificate files live in your Apple Developer account and can be downloaded onto any machine, the private key never leaves the Mac where it was created unless you explicitly export it.

When you set up a new Mac and sign in to Xcode with your Apple ID, Xcode can download your existing provisioning profiles and public certificates, but it cannot download the private key from your old Mac’s Keychain. Without that private key, Xcode reports Valid signing identity not found and refuses to sign or run builds on a physical iPhone or iPad.

A backed-up .certSigningRequest (CSR) file also cannot solve this on its own. When you originally created the CSR in Keychain Access, macOS generated a public/private key pair locally and sent only the public key inside the CSR to Apple. The CSR does not contain the private key.

How to fix it

1. Export your signing identity from the old Mac (best option)

If you still have access to your old Mac, transfer both the certificate and its private key to the new Mac.

Option A: Export as a .p12 file via Keychain Access

1. On your old Mac, open Keychain Access (Applications > Utilities > Keychain Access).
2. Select the login keychain in the sidebar and click My Certificates.
3. Locate your Apple Development or iOS Development certificate. Click the disclosure arrow next to it to confirm a private key is nested underneath.
4. Right-click the certificate (or select both the certificate and private key) and choose Export Items….
5. Save the file in Personal Information Exchange (.p12) format and set a strong password.
6. Copy the .p12 file to your new Mac and double-click it.
7. Enter the password you created and add the identity to the login keychain.

Option B: Export your Xcode developer profile

1. On your old Mac, open Xcode and go to Xcode > Settings > Accounts (or Preferences > Accounts on older macOS/Xcode versions).
2. Select your Apple ID in the left column.
3. Use the action menu at the bottom-left to export your Apple ID and code signing assets, then protect the file with a password.
4. Copy the exported profile to your new Mac, open Xcode > Settings > Accounts, and import it.

Once imported, restart Xcode and refresh your provisioning profiles under Signing & Capabilities.

2. Create a new certificate if the old Mac is unavailable

If your old Mac’s drive failed or you no longer have access to it, you cannot recover the original private key. Instead, issue a new certificate on the new Mac and link it to your provisioning profiles.

Using Automatic Signing in Xcode (fastest):

1. On your new Mac, open Xcode > Settings > Accounts and sign in with your Apple ID.
2. Select your team and click Manage Certificates….
3. Click the + button and choose Apple Development (and Apple Distribution if you archive builds for TestFlight or the App Store).
4. Open your project, select your app target, and go to Signing & Capabilities.
5. Enable Automatically manage signing and select your Team. Xcode will generate a new certificate and update your development provisioning profiles.

Using the Apple Developer portal (for manual signing):

1. On your new Mac, open Keychain Access and choose Keychain Access > Certificate Assistant > Request a Certificate From a Certificate Authority….
2. Enter your email address, select Saved to disk, and save the new .certSigningRequest file.
3. Sign in to the Apple Developer portal and open Certificates, Identifiers & Profiles.
4. Go to Certificates, revoke the old certificate you no longer have the private key for (if needed), and click + to create a new one using the new CSR.
5. Download the new .cer file and double-click it to install it into your login keychain.
6. Go to Profiles in the Apple Developer portal, edit each affected provisioning profile, select your new certificate, and regenerate the profile.
7. Download the updated .mobileprovision files and double-click them (or drag them onto the Xcode icon in the Dock) to install them.

3. Verify the signing identity in Terminal

After importing your .p12 or creating a new certificate, confirm that macOS recognizes a valid signing identity with its private key:

security find-identity -v -p codesigning

If your setup is healthy, you will see one or more entries with a valid SHA-1 hash and certificate name, such as:

  1) A1B2C3D4E5F6... "Apple Development: Your Name (TEAMID1234)"
     1 valid identities found

If the command returns 0 valid identities found, the private key is still missing from the login keychain, or the certificate’s trust chain is incomplete. Check Keychain Access > My Certificates to ensure the certificate has a nested private key and is not marked as expired or untrusted.

If Xcode still does not display your provisioning profiles after installing a valid identity, clear the local cache and let Xcode re-download them:

rm -rf ~/Library/MobileDevice/Provisioning\ Profiles/*

Then reopen Xcode and trigger a build or click Download Manual Profiles in Settings > Accounts.

How to prevent it

• Back up your .p12 files: Whenever you generate a new development or distribution certificate, export it with its private key as a password-protected .p12 file and store it in your password manager.
• Prefer Automatic Signing for development: Keeping Automatically manage signing enabled allows Xcode to create a machine-specific development certificate on each new Mac without disturbing your teammates’ machines.
• Export before wiping an old Mac: Always export your login keychain signing identities or Xcode account assets before erasing or trading in a development machine.
• Use separate certificates per Mac: Apple Developer accounts allow multiple development certificates per team, so you can keep one per computer instead of sharing a single private key everywhere.

FAQ

Can I use my backed-up .certSigningRequest file to fix this on a new Mac?

No. A .certSigningRequest (CSR) file only contains your public key and identity metadata. The matching private key stays inside the login keychain on the Mac that generated the CSR, so you must either export a .p12 file from that Mac or generate a brand-new CSR and certificate on the new Mac.

Why don’t my provisioning profiles show up in Xcode on the new Mac?

Xcode hides or marks provisioning profiles as unusable when no matching signing identity exists in your Keychain, or when your Apple ID session in Xcode > Settings > Accounts needs to be refreshed. Once a valid certificate and private key are in your login keychain, click Download Manual Profiles or toggle Automatically manage signing to pull the profiles down.

Will revoking my development or distribution certificate affect apps already on the App Store?

No. Revoking an App Store distribution or development certificate does not remove or break apps that are already live on the App Store. However, any existing provisioning profiles tied to the revoked certificate will become invalid for future builds, so you will need to regenerate those profiles with your new certificate before submitting an update.