P12 and Mobileprovision Files Explained: iPhone Signing Certificates

ByScarlet iOS Team Updated on

On-device signers such as Feather and KSign ask for two files before they can install anything: a .p12 certificate and a .mobileprovision profile. Many people get these files from someone else without knowing what they contain or what can go wrong. This guide explains both files, how to check them, and the risks, using Apple’s own documentation.

The Risks First

  • A .p12 file contains a private key. Whoever has the file and its password can sign apps as that developer. Never post it publicly or send it to people you do not trust.
  • Apple can revoke any certificate. Apple’s documentation says it “can revoke digital certificates at any time at its sole discretion.” When that happens, apps signed with it stop working.
  • Shared and bought certificates get revoked most often. A certificate that many strangers use for public distribution is outside the terms it was issued under. You cannot control when it is revoked, and money paid for it is usually not refunded. See enterprise certificate safety.
  • The certificate does not check the app. Signing says who signed an app, not whether it is safe. Check IPA files yourself: see how to scan IPA files for malware.

What a .p12 File Is

A signing certificate on its own is public. What lets someone actually sign apps is the certificate together with its private key, which is created on the developer’s Mac. Apple’s Keychain Access guide describes the .p12 format (Personal Information Exchange) as a file that “can be imported as a backup of your digital certificate and private key”. When you export it, Keychain Access asks for a password, and that password is needed to import it again. That is why signers ask for a .p12 file and a password.

Apple issues different certificate types. For installing on iPhones outside the App Store, the ones you meet are development certificates, distribution certificates from a paid Apple Developer Program membership, and in-house distribution certificates from the Apple Developer Enterprise Program.

What a .mobileprovision File Is

A provisioning profile is a file signed by Apple that says which apps may run, signed by whom, on which devices and with which permissions. Apple’s technical note TN3125 lists what is inside:

  • DeveloperCertificates: the certificates allowed to sign apps covered by the profile. Your .p12 must match one of them.
  • App ID: most profiles apply to a single App ID. A wildcard App ID can cover many apps.
  • Devices: most profiles list specific devices by UDID (ProvisionedDevices). In-House (Enterprise) profiles instead have ProvisionsAllDevices, so they work on any device. See how to find your iPhone UDID.
  • ExpirationDate: every profile has one. After that date the profile is no longer valid.
  • Entitlements: an allowlist of capabilities such as push notifications or app groups. Apple says every entitlement an app claims must be in the profile’s allowlist.

Apple also explains that the device checks the profile’s signature, then checks that the app meets the profile’s criteria. If the app’s signing certificate, App ID, device or entitlements do not match, iOS will not run it.

How to Check the Files Yourself

  • Inside a signer: Feather lists “detailed information about apps and your certificates” among its features, so after importing you can see the name, type and expiry there.
  • On a Mac: Apple’s TN3125 shows how to decode a profile in Terminal with security cms -D -i profile.mobileprovision. The output includes ExpirationDate, the device list or ProvisionsAllDevices, and the entitlements.
  • Check that the pair matches: the certificate inside the .p12 must be one of the profile’s DeveloperCertificates. A mismatch is a common reason a signer reports an error before installing.

Common Problems With Certificate Files

  • Wrong password: the .p12 will not import. Only the person who exported it knows the password.
  • Profile expired: apps signed with it stop opening after the expiry date. You need a new profile, and then re-sign the apps. See how to resign IPA files.
  • Device not in the profile: for development and ad hoc profiles, your UDID must be listed. Otherwise the install fails, often as “integrity could not be verified”: see the integrity error fixes.
  • Certificate revoked: every app signed with it stops at once, and no setting on the iPhone changes that. See what to do after a revoke.
  • Missing entitlement: an app that needs a capability the profile does not allow can install but fail at that feature, or not install at all.

Where Scarlet iOS Fits

Scarlet does not ask you for a .p12 or a profile. It signs with a shared certificate instead of your Apple ID, which is why setup is simple, and also why every app installed through it stops opening when Apple revokes that certificate. Scarlet is confirmed on iOS 14 through iOS 26; iOS 27 support is reported by third parties but not officially confirmed. If you have your own certificate from the Apple Developer Program, a signer such as Feather or KSign uses it directly. For the trade-offs, see on-device vs computer signing.

FAQ

Can I make a .p12 and profile with a free Apple ID?

A free Apple ID gives you a personal team certificate that tools like Xcode, Sideloadly and SideStore manage for you. Profiles from it last 7 days. Signers built for .p12 files are mainly meant for paid developer certificates.

Is it safe to use a certificate someone shared online?

It works until it is revoked, which can happen at any time and without notice. You also cannot know who else holds the private key. Treat it as temporary and never sign anything sensitive with it.

Does a new profile fix a revoked certificate?

No. A profile names the certificates it allows. If the certificate is revoked, you need a different certificate and a profile that includes it.

Similar Posts