Apple signing certificates and provisioning profiles: expiry dates

Apple signing assets expire, and the failure shows up at the worst moment: a CI build that suddenly cannot sign, or an enterprise-distributed app that stops launching.

Do not assume a lifetime

Check the expiry date shown in your developer account or in Keychain Access rather than assuming a length. Profiles have their own expiry date and must be regenerated if they expire or a certificate they reference is revoked.

Developer ID certificates (for software distributed outside the Mac App Store) expire too. Apple says apps signed while the certificate was valid keep running after it expires, but you need a new certificate to sign updates. Apple also says Developer ID provisioning profiles created after February 22, 2017 last 18 years.

See the dates

Your developer account (Certificates, Identifiers & Profiles) and Keychain Access show certificate expiry dates. Profiles show theirs in the account too.

Renewal that does not break CI (typical steps)

1. Create the new certificate and export it with its private key.
2. Regenerate any provisioning profiles that referenced the old certificate.
3. Update the secrets in your CI system and in any signing tool you use.
4. Run a test build before the old certificate expires.

Questions

Do apps already on the App Store stop working when the certificate expires?

No. Apple says existing App Store apps are not affected, but you cannot upload new apps or updates with an expired certificate.

What about in-house (enterprise) apps?

For in-house apps, Apple says an expired or revoked distribution certificate stops installed apps from running. Check the profile expiry too.

Track this in the free tracker

Guides last checked 2026-10-18. Check the details against your vendor's current documentation; products and policies change.