Signing certificates and Apple's certificate limit

Apple only takes apps that are signed. StoreReady does the signing for you, with your App Store Connect key:

• A distribution certificate. It proves the app comes from your developer account.
• A provisioning profile. It ties your app's App ID to that certificate.

We make them on your first iOS build, keep them encrypted and make new profiles when they're needed. You never open Xcode or Keychain. Your app's Settings → Stores → Distribution certificate shows which certificate signs your apps and until when.

Apple's certificate limit

Apple lets each developer team hold only a few distribution certificates at a time, usually 3. If the team was used before, by Xcode on a computer, by another build service or by a developer who helped you, the places may already be taken. Then Apple refuses to make a new one, and StoreReady shows two ways out, when you start a build or on the build page.

Way 1: use a certificate you already have

Nothing changes for your other tools. StoreReady signs with your certificate and makes none of its own.

Export it from Keychain Access

Do this on the Mac you publish from, the one the certificate was made on.

1. Press Command + Space, type Keychain Access and open it.
2. On the left pick the login keychain, then the My Certificates tab at the top.
3. Find the one named Apple Distribution: your name or company (your team ID). Press the small arrow next to it: a private key has to show up under it. No key means this Mac does not hold it, use the Mac it was made on.
4. Right-click the certificate and choose Export "Apple Distribution: …".
5. File Format: Personal Information Exchange (.p12). Press Save.
6. Type a password for the file twice. You type it in StoreReady too.
7. Your Mac asks for its own login password to let the key out. Type it and press Allow.

Several of them? Use the one that expires last. Apple Development certificates are for testing and do not work for the App Store.

Upload it

1. In your app's Settings → Stores, next to Distribution certificate, press Use my certificate.
2. Choose the .p12 file and type its password.
3. Press Check the certificate. We check with Apple that it is an Apple Distribution certificate of your team and still current.
4. Press Save this certificate, then start the build again.

It signs every app of yours on that Apple team. The file is stored encrypted, and its key only reaches the build machine at the moment it signs.

Way 2: revoke a certificate you no longer use

1. Open developer.apple.com → Certificates and sign in as the Account Holder or an Admin.
2. Look at the ones whose type says Distribution. Each shows who made it and when it expires.
3. Click one you no longer use, for example one made on an old computer or by a service you stopped using.
4. Press Revoke, then Revoke again to confirm.
5. In StoreReady start the build again. It makes its own certificate in the free place and carries on.

What revoking does and doesn't do

• Apps already in the App Store are not affected. People can still download and open them.
• New builds can't use the revoked certificate. A computer, a CI service or another tool that still signs with it cannot any more. Not sure? Use Way 1 instead.
• Push notification keys are separate. Revoking a certificate doesn't touch them.

Good to know

• Your certificate expires? Apple certificates last a year. Upload the new one the same way, or let StoreReady make one if there is a free place.
• Built the app yourself? An .ipa you exported for the App Store is signed already, so it needs no certificate from StoreReady. See Upload a build you made yourself.
• Stuck? Write to help@storeready.app and we'll look at it with you.