Over the past couple of days I've worked my way through all the prior posts on here that I could find that seemed to be related (many of them appear to be horrifically out of date and less than useful now), as well as the Apple Troubleshooting and Maintaining Your Signing Identities and Certificate guides (not to mention the usual Internet searches).
The app in question was deploying fine until the latest XCode update, but now fails to upload (build is successful obviously, and there have been code changes as well):
ERROR ITMS-90161: "Invalid Provisioning Profile. The provisioning profile included in the bundle *content removed* is invalid. [Missing code-signing certificate]. A Distribution Provisioning profile should be used when submitting apps to the App Store. For more information, visit the iOS Developer Portal."
It's not the first time I've mysteriously had a failure like this, but in prior cases simply revoking the certs, removing the profile, then rebuilding would take care of it. Not so in this case.
The provisioning profile is confirmed to be the correct type, and the code signing certificate sure looks like it's in there... Certificate gets a nice green checkmark too. Any new suggestions not covered in the usual places?
It turns out that there's nothing wrong with the certificate itself, but it's the upload process which needs to be done different.
In the past I had been deploying the distribution outputs from Cordova CLI via the Application Loader. The App store no longer accepts my builds when done that way.
With the current version of XCode, I need to use the GUI now and set the build target to "Generic iOS Device" and then do an "Archive" operation. The archive will upload the app through a different loader, which the App store will accept.
I recently created a new target in my project for the Lite version of my app. Now when I go to upload the .ipa to TestFlight so I can distribute it to my designer, I'm getting:
Invalid IPA: The keychain-access-group in the embedded.mobileprovision
and your binary don't match.
Seems clear to me the reason this is happening is because of the new target. Does anyone know what exactly do I need to change to get this to work?
I had this same problem. It was caused by having the wrong release code signing identity in the target's build settings. You won't need an entitlements file.
Check you are code signing with the correct Distribution profile.
Under Xcode project select > Build Settings > Code Signing
Code Signing Identity:
- Debug > iPhone Developer
- Release > iPhone Distribution
Provisioning Profile:
- Be sure to select a Distribution profile here!
When you created a new bundle you probably didn't change the entitlements and access groups. Make sure you change these in the entitlements file. Have a look at http://www.karlmonaghan.com/2012/08/09/invalid-ipa-the-keychain-access-group-in-the-embedded-mobileprovision-and-your-binary-dont-match/ on how to do this.
Should look like this
If you don't use an entitlements file...
Double check that your developer certificate and provisioning profile used are up-to-date (even if you have the confidence inspiring green tick in the organiser.) Refresh the profile by visiting the Apple Provisioning Portal and edit / modify the provisioning profile, you're using to sign the app.
Un-click and click the signing identity, so that you can submit the form, and the profile will be regenerated.
Wait a minute (really), Go back to XCode and remove the profile from the organiser, next refresh the profiles, and it should re-appear, as the regenerated version.
Once that's done, try archiving / signing the ipa, and upload to TestFlight.
(use the TestFlight app, to speed up this process.)
Here's what worked for me:
Using Automatic (Enterprise Distribution) Profile Selection for all Code Signing Identities I've Established.
Selecting "Refresh Certificates" when going through the Enterprise/Ad Hoc distribution workflow
I have such kind of problem, I am not sure you have the same one or not.
If I have a installed app with the same app id that I am going to install but with a different target, it creates problem. Seems apps are unique with app id and target. So I had to delete the app to install another app with the same app id but different target.
You have good other answers here, but just to stress something out.
If you worked for more than 1 client, and you actually used more than 1 developer account, then the automatic selection of Code Signing Identity on Archive wizard could be different than the one you need, and you might need to select it each time you create the AdHoc version.
Here is a picture, to show you where your error might be (thats where mine was):
This question is, in some ways, a follow up on my earlier question regarding Push Notifications. After much time wasted I have more or less concluded that the issues I am running into, particularly with Titanium, are down to my not configuring my Keychain in the right order. I am now contemplating redoing it all from scratch but thought it best to first post a question here to establish the right way. Here is what I am planning to do
Log in to my Apple iOS provisioning portal account, download and install the Apple WWDRCA cert
Open up KeyChain and create a new certificate signing request. I call it myname.certS... .
Go to the provisioning portal account and use the CSR created above to secure my development and production certificates.
Download and install those certs on my machine by double clicking on them
Back in the provisioning portal create my first appID - call it, com.example.push
Back in KeyChain create a new csr - push.certSig... .
Back in the provisioning portal choose the new appID and configure it for Push using the new csr
Still in the provisioning portal select Devices and add the UUIDs for the devices on which I want to test my app
Still in the provisioning portal select Provisioning and create a new development and production provisioning profile for the app. The latter has AdHoc selected. Use the certificates created earlier. At this stage assign only one device in each profile.
Submit the profile, wait then edit it and add the remaining devices - I am doing this because I have read that there is bug somewhere that stops the provisioning profile from using the Push configuration for the appID in question the first time round
Download and install the two provisioning profiles
Well as I write I have followed all of these steps. I then wrote and compiled a simple Titanium mobile project and tried the Install To Device option with the AdHoc profile created above. Everything went swimmingly well and I got my IPA. I took the IPA and fed it to TestFlightApp which reported Invalid Profile: developer build entitlements must have get-task-allow set to true. So I tried again with the Development profile. This time round TestFlightApp accepted the IPA. In installed it on my iPad but still find that registerForPushNotifications is going away into the ether with nothing being reported - no success, no erors... just a defeaning silence.
I have to admit that I am at my wits end here. I am clearly doing something wrong but I haven't got the foggiest idea what it could be. If I had a million dollars I would give em away to anyone who could set me on the right track. Well I don't so I hope someone just puts me on the right track out of sheer goodness
tried the Install To Device option with the AdHoc profile created above. Everything went swimmingly well and I got my IPA
That doesn't sound right. You aren't installing to a device, you're generating a distributable build. I'm not familiar with Titanium's build process, but in Xcode 4, you select Archive to generate the IPA, and Xcode generates the appropriate entitlements at that point. If you're using an option intended to install directly onto a device, it won't generate those entitlements.
So I tried again with the Development profile.
This doesn't sound right either. You should be using the distribution profile.
I am getting the 'dreaded' error The entitlements specified in your application’s Code Signing Entitlements file do not match those specified in your provisioning profile.
(0xE8008016). when trying to deploy my first app to an un-jailbroken device on iOS 4.2.6 (Verizon). The thing is, I do not have a Entitlements file in my project, as I am not distributing it at all, only putting it on one device. I have gone through all the hoops and loops apple puts you through (certificate, device, provisioning) down to the letter, and I cannot figure out what is going wrong.
Can anyone please help me with this problem?
Just came across this issue myself, the problem was that I had a Entitlements.plist file in the project as part of an ad hoc distribution, and its get-task-allow (ie. 'can be debugged') property was set to NO - setting this to YES fixed the issue and allowed the app to run from Xcode4 on the device in development.
Naturally need to set it back to NO for ad hoc distributions, but just thought I'd mention it in case anyone else comes across the same problem.
I had this issue with Xcode 4.2.1.
For me it was nothing to do with Entitlements file, or Ad-hoc...
I was returning to and old project, and I'd forgotten to add my new iPhone to the provision.
Silly mistake, but also a silly corresponding error message... :-/
If you're using react-native, make sure that the Test target has the same provisioning profile as the main one.
I've had this issue with the iCloud entitlements. My problem was that I forgot to enable iCloud for my App ID in the Provisioning Portal.
After enabling iCloud for your App ID, you will need to recreate the provisioning profiles.
Keep your entitlements file in Target> Build Settings > Code Signing > Code Signing Entitlements.
Go to Target > Capabilities.
Toggle On/Off or Off/On one of the capabilities.
Run.
What worked for me was to completely delete the entitlements file, from the groups list, and from the Build Settings in both Project and Target. Then I recreated the entitlements from the Summary tab in the target, and it loaded fine without any error messages.
Just putting in my 5 cents here. For me none of the above worked, so I was forced to stress down and actually look at every part of the process with fresh eyes.
In rushing this I forgot that I was trying to install my app on a totally new device.
So my error was that I hadn't updated my provisioning profile by ticking off my new device int the "Devices" section of the provisioning profile setup in the Provisioning Portal.
Apparently not including your device in the provisioning profile also generates this error message.
None of the many answers fixed the 0xE8008016 Error for me.
But when I chose "Automatic Device Provisioning" in Xcode 4 > Organizer > Devices > Provisioning Profiles, it finally worked.
In my case it was a stupid mistake. I incorrectly set the "Run" scheme to use the "Distribution" build configuration instead of the "Debug" or "Release" one.
Stupid mistake, but it took a while to debug it, so I'm going to add my answer to improve the knowledge base inside stack overflow!
Delete your provisioning profiles, do a 'Clean All', make sure that your provisioning setting are correct, redownload, and try to run again.
Open 'iOS Provisioning Portal' in Safari.
Tap 'Devices' in the sidebar.
Register your device's UDID
Tap 'Provisioning Profiles'
Edit your apps profile.
Select the device your have just added.
Download the .mobileprovision file.
Install it.
Build again.
I had the same problem in my app, after a few month this specific app worked fine.
The problem was that the Capabilities configured in my Xcode project (under Targets -> {ProjectName} -> Capabilities) were not the same as the Capabilities configured in the provisioning profile (you can check that in the Apple member centre under Identifier -> App Ids -> {your app ID}. In the member centre I saw that Game Center is enabled and so in my project I also enabled Game Center. Then the app was able to launch.
I don't know how it worked until now. That's still a mystery :)
For me check the "Automatically manage signing" option in Target solve the problem!
Upgrading to XCode 4 fixed the issue.
Deleting the xcuserdata folder solved my issue. More on that here: https://stackoverflow.com/a/9968884/300694
If you didn't change anything related to certificates (didn't replace or update them) just do a Product -> Clean. It helped me several times. (Xcode 6.2)
I ran into this problem today and I was pulling my hair out trying to figure it out. Like many people here, it would work if I removed the iCloud options in my entitlement file. When I would go to debug the app with the iCloud options enabled then I would get the 0xe8008016 error. This was right after revoking and regenerating new certificates.
So what solved it for me was to turn on iCloud support for the automatically generated Xcode team profile. Log onto the online provisioning tool, go to App IDs, click on Xcode iOS Wildcard App ID, click on edit, enable iCloud by checking the checkbox, and finally clicking Done. Refresh your profiles in Xcode and then it will start to work.
This makes some sense - when you're debugging it defaults to the team profile and the team profile needs to have iCloud turned on.
Happened to me when I was trying to use an app store distribution provisioning profile for local test by mistake. When I used the proper development profile it worked just fine. Maybe this helps somebody too.
This worked for me...
I deleted the Entitlements file from the target.
Deleted the app off all my devices
Cleaned the build in Xcode
*optional delete the provisioning profile and re-add it
Hope it works for you guys too :)
This is what solved my problem: Deleting the path in the Code Signing Entitlements section of the Targets build settings.
My provisioning profile from Apple developer matched my Xcode capabilities but it still wouldn't build onto my device until I did the following:
Remove/Delete the entitlements file from your Xcode project.
Go back to the Xcode capabilities tab
Hit "Fix Issue" button to get Xcode to re-add the entitlements file.
Worked for me, hope it helps someone.
Happened to me on Xcode 8, it was partially caused by the new Provisioning Profile build setting, as in this Xcode version there are two entries for provisioning profile:
Provisioning Profile
Provisioning Profile (Deprecated)
My fault was that I updated only the first one, and the deprecated entry was still pointing to an invalid provisioning profile. Changing both to the same value solved the issue (clearing the deprecated entry should also have the same effect).
In my case, it looks like Xcode (secretly) reset the Scheme.
I found that the build configuration for Archive was set to Release instead of distribution one, and after I changed it to the correct one, it worked.
I think it is better to check the Schemes as well as the build settings.
I had old project and same problem and I solved .
1.Go to summary
2.Summary have keychain groups and delete keychanin
groups's object.
I hope it's will work for you .
Regards.
i'm using xcode 6 and encounter this issue for one particular iphone 4
finally , i go to device => provision profile =>
and then add the profile manually and problem is fixed .
For me in Xcode 5.1 I was getting The entitlements specified in your application’s Code Signing Entitlements file do not match those specified in your provisioning profile. when trying to test the app on my device. Device Development Certificate has to expire Feb 2015.
Issue was resolved:
Selected Target->Capabilities, under GameCenter, here I was getting error on GameCenter entitlement as it was not added to project, although first version of application was released via same XCode 5.1 but there were no errors like this before.
Below, a button was given with title Fix Issue. When clicked it added the GameCenter entitlement and issue was resolved.
After wards the screen looks like:
For me, there was nothing to do with certificate. App now runs successfully on the device.
One more potential problem that will throw this error message: If you're using a perfectly valid provisioning profile for you main app, but have an expired or otherwise invalid provisioning profile for your Today widget extension. I imagine it'd be the same for an Apple watch extension as well.
Check all the profiles!
Check KeyChain Access!
In my case I was using the wrong distribution certificate associated with the provisioning profile.
The code I was working on had a different bundleid in the Info-plist than in the Product Bundle Identifier build setting.
I found this because I noticed this message in the device console in the devices view:
MIS: entitlement 'application-identifier' has value not permitted by provisioning profile 'iOS Team Provisioning Profile: com.xxx.yyy'
If you are trying to activate iCloud syncing, you will need to enable iCloud for the AppID that is used to create the development provisioning profile (which Xcode does automatically). You'll also need to enable this for distribution profiles as well.
The tricky part is that when you refresh profiles in Xcode, this does not trigger a renewal of the profiles; they are simply re-downloaded. So in your iOS Provisioning Portal under Provisioning/Development, you'll need to check the profile that is labeled (Managed by Xcode) and delete it (Remove Selected button). Do this for ALL profiles, development & distribution, that you need to regenerate.
Now, in Xcode in the Organizer, delete provisioning profiles that you are about to replace.
Now to get new ones. If you develop for more than one team and only want to refresh a particular one, select the appropriate Team in the left pane under TEAMS, otherwise select Provisioning Profiles under LIBRARY, then select Refresh.
Finally, remove any old provisioning profiles on your device that could conflict with the new ones since profiles are never deleted automatically; newer profiles are simply added to the list.
Finally got MGTwitterEngine stuff to
compile (by setting the Header Search Paths to /usr/include/libxml2 iphoneos3.0/usr/lib/libxml2)
AND link (by removing the Twitter LibXML Parsers code and assigning a weak role to libxml2.2.dylib in Targets: Link Binary With Libraries).
But when I do a Build and Go to the iPhone (not the simulator), I get this error:
"This provisioning profile does not have a valid signature (or it has a valid, but untrusted signature)."
I have followed the official Apple Developer process of getting a certificate and provisioning, etc. Obviously, I did something wrong somewhere. Has anyone come across this problem or have any ideas on how to solve it?
Things to check:
In Keychain Access, make sure you have a code sign identity (public and private keys and a certificate titled "iPhone Developer: Your Name"
In your Info.plist, make sure your Bundle Identifier matches your App ID that you created in the dev portal
Make sure you installed the .mobileprovision (from Terminal> open x.mobileprovision)
In the dev portal, make sure your provisioning profile has your certificate, your App ID, and your device all enabled. If it doesn't, fix that and re-download and re-install your provisioning profile.
Follow the instructions very carefully when creating your Certificate. One time, in Keychain Access, when I went to Request a Certificate, I had something else selected in the list panel and so it created the wrong kind of certificate. Make sure nothing in the list is selected when you do this part.
Restarting Xcode may also work... (Work for me couple of times)
Troy It looks like the issue is you don't have a keypair that is tied to the provisioning profile installed. It's tough to tell for sure but that is my best guess.
If that is the case, I've been working in a similar situation - what you need is to either generate a private key using the iphone development portal under the same account your boss used and then add that new key to the provisioning profile you are building with.
OR
You can get your boss to export the key he generated when he created the provisioning profile - he can export it from keychain and give it a password that will allow you to install it but protect it from anyone else installing it.
I guess the fifth time's the charm. I basically deleted the certificate and the provisioning file, etc., and started completely over. Viola! Now for those pesky memory leaks! :-) Oh, Java, wherefore art thou, Java? (and your majic garbage collection!)
One of the things that I tried and worked for me was to reset the keychain access
http://support.apple.com/kb/TS1544