Here we are again; Distribution Profile hell

So , once again, certificates and profiles expired.
I renew and download and install everything I can find.
And once again Xojo tells me I need a distribution profile for the iOS app

I can create an app with the same bundle identifier in Xcode and it reports it is happy to build , sign , and distribute .
Xojo says there is no provisioning profile, and the error message even tells me what Xojo need to say on the command line to make Xcode do the profiling automatically.

Q1: Why doesnt Xojo pass the command line to Xcode?
Q2: If Xcode works with that bundle ID, what do I need to do to make Xojo happy?

Xojo 2021

1 Like

If this command line is ‘all’ that is needed, why can Xojo not use it?

Sorry to hear that Jeff, but I went through the same problem just before Christmas. It’s like some sort of magic trick that I don’t understand. I had to delete all my certificates and try and remember how I put it together from scratch. I also deleted something I shouldn’t have from memory so make sure to back up everything before hand if you need to go down that route :frowning:

And thats my concern.
My iOS apps are piddly little things that would barely pay for the iPad and the Apple developer fee, (let alone a Xojo iOS licence.)

But if I mess up Mac signing while trying to fix iOS, I’d literally be out of business.
Im terrified of throwing the baby our with the bath water.

1 Like

Go back and look at my blog post from the fall. It explains the dependencies between the different certs and profiles and the order that everything needs to be created and installed. I think that you’ll have more success following those instructions (I certainly do).

As for “why Xojo can’t just use that xcodebuild flag,” they don’t use xcodebuild. Remember, Xojo uses llvm to compile your app directly from Xojo code and nothing is passed through Xcode at that point.

1 Like

Sadly, that was the first place I looked.
All I could take away from it is ‘stuff is important’
Its probably a good guide if you start as a new developer.
But Im a year or 6 in, and my certificates and profiles screen in the Apple site is full of stuff I have no apparent way to remove.

All the things mentioned in the blog, I believe I have done… probably some of them too many times, as Apple won’t let me make any new certificates, and since they don’t have unique names, I cannot tell which ones are supposed to be used with what.

I’d love to know how CodeMagic achieves this for other development tools.

Go to XCode → preferences → accounts, select the team and click “Download Manual Profiles” (make sure you actually generated the profiles on your
Restarting xojo (may not be required, but hey who knows)

Many many times. No joy.

Did you generate new profiles using the new certfiicates?
Did you reboot your mac after?


I went back to the blog, and putting my preconceptions in a bucket, I read all the things mentioned.

Despite making many distribution profiles (because I am trying to distribute!!) , I also created a new development profile (the sort you need for testing)

Suddenly I can build an IPA for App Store.
I dont understand, but I’m relieved.

1 Like

I’m sorry you are having trouble with this, but as I mention in that blog post, if the four pieces in your account for the app identifier are not exactly correct, you’re still going to have trouble.

Xcode has the wonderful advantage that it’s created by Apple and that it’s tightly integrated into the developer portal, so they can update & download profiles any time they want to.

Here are the four types and the button name for removing with a short hint.

Certificates: Revoke
Typically you shouldn’t need to remove certificates unless you’ve actually lost the private key. A full certificate which contains a public and private key can only be downloaded once. Pressing the Download button afterwards will only get you the public key.

Identifiers: Remove
Certainly if you have identifiers that you are no longer using, don’t keep them around. Also, while some improvements were made in how Xojo deals with wildcard identifiers in 2021r3, I still don’t use them myself because I still find edge cases that don’t work in Xojo or in Xcode.

Devices: Disable
They can be removed once per year when your account renews. Personally I tend to keep lots of old devices around for testing purposes.

Profiles: Remove
Profiles are perhaps the trickiest part of the bunch because they are the glue that holds the other three pieces together. You’ll need a Development profile and an App Store profile ultimately to get your app into the App Store. The Development profile links your Development certificate, the App Identifier and the devices it can be tested on and is used when you copy an app to a device for testing purposes. the App Store profile links an App ID and a Distribution certificate and is used to put your app into the App Store.

I suspect that the thing that is missing is the actual update of the profiles when something changes in Certificates, Identifiers or Devices. It’s not enough to just go to the Profiles list and click Download, you actually need to click on the name to open the detail screen, click the Edit button, make sure everything is correct and then click the Save button even if you’re not changing anything because the profiles contain some of the other parts. Once a new profile has been created, click the Download button and double-click the file on your computer.


@Greg_O_Lone Can you have two identifier certificates of the same name but with different bundle identifier eg one for desktop and one for IOS?

I spoke too soon, I just tried to build an app for the store and I am getting errors :frowning:

Hell, isn’t it?

I got one iOS app working this week.
In the process I have messed up my MAS stuff, but I dont sell through MAS so I’ll live with it unless it bites me.

Apple ‘support’ have agreed that the process is complex and confusing and basically said ‘read our web pages- byeeee!!’

Mind you… I have an even older iOS app that I have not been able to update for over 2 years.

So today I tried to deal with that.
And it worked!

So this is what I did today:

I have 3 certificates at the moment… after some testing, only one of them (the most recent) works for me, but I know which one it is.

So for my really old app:

I already have an app ID set up, but if I didnt, I would have to create one.
Then I went to the Certifcates, Identifiers etc page in my dev account, and in this order

1/ Created a distribution profile for that ID , downloaded, and double clicked.
2/ Created a development profile , for that ID, for all devices that I have registered. (It shows many devices, and several certifcates on the confirmation page). Download that, double click it.

In the past I would have tried creating a dummy app in Xcode, but I didnt bother.

Then I tried a build for App store in Xojo, and bingo!
(At the Xojo end, you need to ensure that the Xojo version matches the Xcode version, however.)

I’m not sure what you mean by Identifier Certificates. Identifiers & Certificates are two different things.

My recollection is that Apple allows the same identifier on iOS and macOS as long as they’re the same app, just for the different platforms.

As far as Certificates, I believe they’ve simplified that so you need only one Developer certificate per developer and that you can only have two Distribution profiles, presumably so you’d have some overlap when one is about to expire and you are migrating your team to a new one.

I am only surmising this, but it seems that Apple expects a development team to want to be able to have developers that come and go from time to time (hence the revocable “Development” certificates), but that they also expect the Distribution certificates to be given to a small group, perhaps a Q/A team, who are not developers. Users with one but not the other can’t make and distribute apps in your company’s name. This all makes perfect sense when you’ve got a large company, but unfortunately makes it seem like overkill for small teams and individuals.

Not sure I said that. :wink:

This page:

This option:

These things:

To get them you have to use options with these names:

It would be nice if they had the same names, but hey ho…

If you look, I wasn’t replying to you.

1 Like

In that case, I usually use

MyApp Development Profile


MyApp Distribution Profile

Or instead of a name, the bundle identifier so they’re really easy to find in the drop down lists.