iOS Certificate Expired or Revoked? What Happens to Your App
An expired or revoked iOS certificate doesn't affect live App Store apps while membership is active. It breaks new uploads, Ad Hoc builds and push.
If your iOS certificate expired or was revoked, versions already live on the App Store are not affected, as long as your developer program membership is still active. Apple’s documentation says so directly. What’s affected is everything after that. You can’t upload new builds signed with that certificate, development and Ad Hoc builds signed with it stop working because their provisioning profiles become invalid, and if a push certificate expires your server can no longer send notifications. What actually removes a live app from the App Store is an expired membership. The fix is to create a new certificate, regenerate the profiles and rebuild. Apple rules are as of October 2026.
How does an expired iOS certificate differ from a revoked one?
| Expired | Revoked | |
|---|---|---|
| How it happens | The certificate reaches its expiration date and stops working | Someone clicked Revoke on the Certificates page, or Apple revoked it |
| Predictable | Yes, the date is in the certificate and the profile | Usually not, a teammate may have done it |
| Effect on profiles | Profiles have their own expiration date and must be regenerated when they expire | Apple states that profiles containing a revoked certificate become invalid immediately |
| Effect on uploaded builds | Apple’s documentation doesn’t mention any | Builds uploaded but not yet submitted for review may be marked as invalid binaries |
| What to do | Request a new certificate and regenerate profiles | Same, and find out who revoked it and why |
Apple’s Revoking privileges page explains who can revoke what. On an organization team, every member can revoke their own development certificate, but only the Account Holder or an Admin can revoke distribution certificates. On an individual account, the Account Holder can revoke all types.
You can’t extend a certificate’s validity. Renewing means requesting a new certificate and switching your profiles over to it.
What happens to live apps, TestFlight and push when a certificate expires?
Apps live on the App Store
For iOS Distribution (App Store) certificates, Apple’s Certificates overview states three things. As long as your Apple Developer Program membership is active, apps already on the App Store aren’t affected. You can no longer upload new apps or updates signed with the expired or revoked certificate to App Store Connect. Builds signed with a revoked certificate that were uploaded to App Store Connect but not yet submitted for review may be marked as Invalid Binary.
Apps your users downloaded from the App Store keep working and keep updating. Your job is to switch to a new certificate before the next build.
TestFlight builds
TestFlight builds are uploaded through App Store Connect, so the same rule applies. After a certificate expires or is revoked, you can’t upload new builds signed with it, and builds signed with a revoked certificate that haven’t been submitted for review may be marked invalid. Apple’s TestFlight overview states that each build can be tested for up to 90 days, after which testers can no longer use it. That limit has nothing to do with certificates.
After a certificate problem, the safest approach is to rebuild with the new certificate, raise the build number, upload a new build and distribute it to testers. For how to raise the build number, see How to set the iOS version and build number.
Ad Hoc and development builds
These builds are installed on phones with registered UDIDs and are allowed to run by the profile inside the app, so they’re hit most directly.
- Certificate revoked. Apple’s Revoke a certificate page states that profiles containing the revoked certificate become invalid. Builds already on phones won’t open, and new installs fail.
- Certificate or profile expired. Apple’s Edit, download, or delete provisioning profiles page states that an expired profile must be regenerated and the app re-signed with the new profile. In practice, installed builds stop opening after the date, and installs fail with signature validation errors such as
0xe8008015. - First launch needs a network connection. Apple’s Provisioning profile updates page states that for members who joined after June 6, 2021, apps signed for development or Ad Hoc check the signing certificate online on first launch, and may not launch without a connection.
You can’t extend the life of these builds. Rebuild with the new certificate and profile, then reinstall on every phone.
Push certificates
For Apple Push Notification service certificates, the Certificates overview states that once the certificate expires or is revoked, you can no longer send notifications to your app. The app itself keeps running but receives no push notifications.
APNs authentication keys (.p8) avoid this problem. Apple’s Communicate with APNs using authentication tokens page states that signing keys don’t expire, though they can be revoked. If you still use a push certificate, take the renewal as a chance to switch to a .p8 key. See iOS push notifications with APNs, from p8 key to your first push.
Enterprise In-House certificates
These are used only for internal apps in the Apple Developer Enterprise Program. Apple states that once such a certificate expires or is revoked, users can no longer run apps signed with it, and you must replace them with a new version signed with a new certificate. Standard developer program accounts aren’t affected.
Expired developer program membership
An expired membership has a much bigger effect than a certificate. Apple’s Resolving access issues page states that when your membership expires, your apps and in-app purchases are removed from the App Store in all countries and regions, while apps already installed on users’ devices remain. You also lose access to Certificates, Identifiers & Profiles, TestFlight, apps and analytics in App Store Connect, the App Store Connect API and more. To restore access, the Account Holder must renew.
Apple’s Devices overview also states that if you don’t renew, all registered test devices are removed 180 days after the membership expires.
Which kind of app does each event affect?
| What happened | Apps live on the App Store | TestFlight | Ad Hoc and development builds | Push |
|---|---|---|---|---|
| Development certificate expired | Not affected | Not affected | Development builds signed with it stop working | Not affected |
| Development certificate revoked | Not affected | Not affected | Related profiles become invalid immediately, development builds won’t open | Not affected |
| Distribution certificate expired | Not affected (with active membership) | Can’t upload new builds with it | Ad Hoc builds signed with it stop working | Not affected |
| Distribution certificate revoked | Not affected (with active membership) | Can’t upload new builds, unsubmitted builds may be marked invalid | Related profiles become invalid immediately, Ad Hoc builds won’t open | Not affected |
| Push certificate expired or revoked | App works, no push notifications | No push notifications | No push notifications | Server can’t send |
| Provisioning profile expired | Not affected | Not affected | Builds signed with it won’t open, regenerate and re-sign | — |
| Membership expired | Removed from all storefronts, installed copies remain | Unavailable | Can’t create certificates or profiles | — |
“Not affected” means the thing in that column isn’t affected. Your next build still needs a valid certificate.
How do you renew an expired certificate?
When a certificate is about to expire or has already stopped working, go through these steps in order. For the full CSR and .p12 commands, see Get an iOS certificate, p12 and provisioning profile on Windows.
- Create a new certificate. Generate a CSR (you can reuse your existing private key). On the Certificates page in Certificates, Identifiers & Profiles, click the plus button, choose the same type, upload the CSR and download the .cer. Distribution certificates must be created by the Account Holder or an Admin.
- Export a .p12. Combine the new .cer with the private key into a .p12 and set an export password.
- Regenerate the profiles. On the Profiles page, edit each profile that uses the old certificate, select the new one, then save and download. Do this for the main app and every extension, and for each Development, Ad Hoc and App Store Connect profile.
- Replace the files in the keychain folder. If you use KXBuild on Windows or Linux, put the new .p12 and .mobileprovision into
<project>/keychain/orKXBUILD_HOME/keychain/, delete the old files, and update thefilename=passwordlines inpassword.properties. See Certificates and signing for the rules. - Rebuild. Rebuild development and Ad Hoc builds and reinstall them on phones. For builds going to the App Store, raise the build number, rebuild and upload.
1kxbuild build .\MyApp.xcodeproj --install
2kxbuild build .\MyApp.xcodeproj -c Release --export app-store
If you leave the old files in place, having old and new copies side by side makes it easy to pick the wrong one and harder to troubleshoot. For errors when a profile’s certificate doesn’t match, see 16 common iOS code signing and .ipa install errors.
How do you avoid certificate expiry problems?
Check expiration dates
You can see a certificate’s expiration date on the Certificates page in the portal, or read it from your local .p12. The command below uses the OpenSSL that comes with Git for Windows and asks for the .p12 password.
1$openssl = "C:\Program Files\Git\mingw64\bin\openssl.exe"
2& $openssl pkcs12 -in .\keychain\distribution.p12 -nokeys -clcerts | & $openssl x509 -noout -subject -enddate
The notAfter= line in the output is the expiration date. For a profile, decode it with the command below and read the ExpirationDate field.
1& $openssl smime -inform DER -verify -noverify -in .\keychain\MyApp_AppStore.mobileprovision -out profile.plist
Set expiration reminders
- Add the expiration date of every certificate and profile to your team calendar, with a reminder one month ahead.
- In CI, add a step that checks
notAfterwith the command above and makes the pipeline warn when expiry is less than 30 days away. - Before you send out an Ad Hoc test build, make sure the profile has enough time left so it doesn’t expire mid-test.
- Your developer program renewal date is under Membership details on the Account page. Put it in the calendar too.
Sharing certificates on a team
- Share one distribution certificate across the team. Distribution certificates belong to the team. One person requests it, exports the .p12 and hands it to the teammates and build machines that produce builds. Don’t request one per person.
- Don’t revoke casually. Revoking a distribution certificate invalidates everyone’s related profiles at once, and Ad Hoc builds under test stop opening too. Before revoking, confirm with the team that nobody still uses it.
- Don’t delete the old certificate before the new one works. While the old certificate is still valid, request the new one, switch the profiles over, confirm new builds build and upload correctly, then let the old certificate expire on its own.
- Back up .p12 files and passwords carefully. Keep them in a password manager or an encrypted team share, and never commit them to the repository. If you lose the private key, you have to request a new certificate.
- Hand over when people leave. When a teammate who holds the distribution private key leaves, decide whether to switch to a new certificate, and update the certificates and passwords stored in CI so an expired or revoked iOS certificate doesn’t break your pipeline.
FAQ
Will my App Store app be removed if the distribution certificate expires?
No. Apple states that as long as your developer program membership is active, apps already on the App Store aren’t affected by an expired or revoked certificate. You just can’t upload new builds with that certificate, so request a new one first.
Can testers still use TestFlight builds after the certificate is revoked?
Apple states that builds signed with a revoked certificate that were uploaded but not yet submitted for review may be marked as invalid binaries. The safe approach is to rebuild with the new certificate, raise the build number, upload a new build and distribute it to testers.
What should I do when an Ad Hoc build suddenly won’t open for anyone?
The distribution certificate was most likely revoked or the profile expired. Check the certificate status in the portal, request a new certificate, regenerate the Ad Hoc profile, rebuild and have testers reinstall.
What should I do when my push certificate expires?
After a push certificate expires your server can’t send notifications, but the app keeps running. Request a new push certificate and update it on your server, or switch to an APNs authentication key (.p8), which Apple states doesn’t expire.
What happens if I don’t renew my developer account?
When your membership expires, your apps and in-app purchases are removed from the App Store in all storefronts, while copies already on users’ devices remain. You also lose access to TestFlight and certificate management until the Account Holder renews.