How to manage Enterprise Distribution certificate expiration?

Asked 9/2, 2012 at 18:20 Answered 19/9, 2013 at 21:52

Our customer has just joined the iOS Developer Enterprise Program. They have signed the app (developed by us) with their Enterprise Distribution and installed it succesfully in some devices via MDM.

As far as I know when my non-enterprise distribution certificate expires I have to renew it. This expiration disables all apps signed with the expired certificate as soon as the devices checks the certificate's validity against Apple’s OCSP server.

Alternatively, I can revoke my non-enterprise distribution before the expiration date and ask for a new one to Apple. Applications signed with the revoked certificate, for example Ad Hoc beta apps, will be disabled according to the same mechanism.

So with my developer program I can't have two valid distribution certificates at the same time. Ok, as developers we can live with that.

Can our customer have two valid Enterprise Distribution certificates at the same time with the iOS Developer Enterprise Program?

According to Apple:

Certificate Validation

The first time an application is opened on a device, the distribution certificate is validated by contacting Apple’s OCSP server. Unless the certificate has been revoked, the app is allowed to run. Inability to contact or get a response from the OCSP server is not interpreted as a revocation. To verify the status, the device must be able to reach ocsp.apple.com. See“Network Configuration Requirements”(page 9).

The OCSP response is cached on the device for the period of time specified by the OCSP server—currently between 3 and 7 days. The validity of the certificate will not be checked again until the device has restarted and the cached response has expired. If a revocation is received at that time, the app will be prevented from running. Revoking a distribution certificate will invalidate all of the applications you have distributed.

An app will not run if the distribution certificate has expired. Currently, distribution certificates are valid for one year. A few weeks before your certificate expires, request a new distribution certificate from the iOS DevCenter, use it to create new distribution provisioning profiles, and then recompile and distribute the updated apps to your users. See “Providing Updated Apps” (page 10)

Am I missing something or is is possible that the employees, with potentially hundreds of iOS devices with several In House apps, can't open their applications while they wait for the resigned apps?

Hatching answered 9/2, 2012 at 18:20 Comment(4)

Can you provide a link for that quote? – Gigahertz 9/2, 2012 at 23:39

Unfortunately I can't. I read it months ago and it seems that Apple removed this content but you can find it here: http://es.scribd.com/doc/72810321/FA-Wireless-Enterprise-App-Distribution – Hatching 10/2, 2012 at 7:59

possible duplicate of iphone app: how to renew an expired distribution certificate through the iOS provisioning portal – Worktable 27/9, 2013 at 20:23

Anyone looking for the above quote: apple.com/hk/en/ipad/business/docs/… – Christinchristina 15/7, 2014 at 14:49

This is an issue that we have been dealing since the last 2 years. The in-house applications do stop working after 1 year. It is a massive exercise for an organization like ours to rebuild hundreds of apps and redeploy it on thousands of devices every year.

For us it is a month long exercise where we rebuild all our apps and inform all users to get new ones through the distribution channel. Still every year some users are left with non-functional apps.

I have filed an enhancement request with Apple(Bug ID#9848075) for this and am still waiting for a reply.

EDIT: The above mentioned bug is closed now. Here's the official response:

Distribution certs for enterprise are now 3 years in duration.

Rustin answered 10/2, 2012 at 10:25 Comment(10)

Hi Vin, my client have told me that they can they have two valid certificates. Therefore I think the resign process of all IPA can be pretty fast using scripts and as you dont need to wait to the expiration date... I guess everything can be ready for that day and all employees can receive the resigned apps by a MDM tool. – Hatching 16/2, 2012 at 17:37

Enterprise certificates now last for 3 years. The provisioning profile however expires after 1 year. This means to keep an app running you just need to push out a new provisioning profile for applicable app IDs. This may just be your wildcard (*) profile. You can use an MDM system to push these profiles out automatically. – Artieartifact 18/6, 2013 at 13:12

hi Vin, why aren't you using an MDM to install the new versions to all devices? – Soledadsolely 9/7, 2013 at 9:14

I doubt the app needs to be rebuilt, only re-signed. I have a provisioning profile that will need to be re-signed soon, so I'm going to try just re-sign the existing app archives before I go back and try to rebuild them all. – Stanzel 12/1, 2014 at 20:57

@RichardVenable re-signing the apps would do but you'd still have to get this new app to users' devices – Rustin 13/1, 2014 at 5:34

So what happens if my certificate hasn't expired, but my provisioning profile has. Would that stop users from running the app? – Politics 24/9, 2015 at 13:9

yes, me too wondering how it will be like if my provisioning profile is expired but not my certificate. Current, I have apps that profile is expired and I am still able to run the app. It would be nice if apple have clear explanation for provisioning profile like Certificates – Quell 15/12, 2015 at 8:49

I wondered what is the difference between AppStore apps that they do not face this problem? Why we only see them in enterprise or Ad-Hod apps – Dvina 21/8, 2018 at 9:23

@JonasStawski, My distribution certificates are up and running. But the provisioning profile is going to expire, I edited the profile and now, that provisioning profile is just fine. Will the app having previous profile stop working? Do I need to update app, code sign with this provisioning profile and ask users to update the app? – Mustache 24/9, 2018 at 13:47

@ JonasStawski @ MinSoe Even if your certificate is valid, your app will stop working as soon as your provisioning profile expires. That's my experience - the app will stop launching on users' devices. (You might have figured it out already - I'm mainly posting for visibility so other people who stumble across this thread know what to expect.) – Monniemono 12/7, 2019 at 20:38

The "missing" link is now http://help.apple.com/iosdeployment-apps/?lang=en#app43ad74a3

A few weeks before your certificate expires, request a new distribution certificate from the iOS Dev Center, use it to create new distribution provisioning profiles, and then recompile and distribute the updated apps to your users.

The document describes also how to update Apps. There are frameworks that include the update mechanism easily into your app. Eg "Hockey", https://github.com/therealkerni/HockeyKit

Quoting the full article:

Certificate validation

The first time a user opens an app, the distribution certificate is validated by contacting Apple’s OCSP server. Unless the certificate has been revoked, the app is allowed to run. Inability to contact or get a response from the OCSP server isn’t interpreted as a revocation. To verify the status, the device must be able to reach ocsp.apple.com. See Network configuration requirements.

The OCSP response is cached on the device for the period of time specified by the OCSP server—currently, between 3 and 7 days. The validity of the certificate isn’t checked again until the device has restarted and the cached response has expired. If a revocation is received at that time, the app is prevented from running. Revoking a distribution certificate invalidates all of the apps you’ve distributed.

An app won’t run if the distribution certificate has expired. Currently, distribution certificates are valid for one year. A few weeks before your certificate expires, request a new distribution certificate from the iOS Dev Center, use it to create new distribution provisioning profiles, and then recompile and distribute the updated apps to your users. See Providing updated apps.

Lakitalaks answered 21/2, 2012 at 22:34 Comment(0)

Note: The hierarchical text below indicates the path to the information that explains the solution. You must navigate to (expand the arrows next to) the items in the sidebar to see the solution (Mani, please don't delete this info - it's there to direct the viewer to the solution.)

Current documentation from Apple:

Distributing Enterprise Apps for iOS Devices
    In-house apps
      Certificate validation
      Providing updated apps

http://developer.apple.com/library/ios/#featuredarticles/FA_Wireless_Enterprise_App_Distribution/Introduction/Introduction.html

From Providing updated apps:

You can have two distribution certificates active at the same time; each is independent from the other. The second certificate is intended to provide an overlapping period during which you can update your apps before the first certificate expires. When requesting your second distribution certificate from the iOS Dev Center, be sure you don’t revoke your first certificate.

That there is not a seamless way to do this so that all our internal customers don't need to see this is rather terrible lack of functionality.

Aragonite answered 14/11, 2012 at 20:10 Comment(1)

Link is broken :( – Multicolor 4/10, 2016 at 17:13

Apple revised the documentation...

An app won’t run if its distribution certificate has expired. Currently, distribution certificates are valid for one year, and you can have two certificates active at the same time. The second certificate is intended to provide an overlapping period during which you can update your apps before the first certificate expires.

For example, six months before your distribution certificate expires, create a new certificate and use it to update your apps for the next year. To do this, you request a new distribution certificate from the iOS Dev Center (do not revoke your first certificate), use it to create new distribution provisioning profiles for each of your apps, and then you recompile and distribute the updated apps to your users. See Providing updated apps.

Detonator answered 11/7, 2012 at 16:58 Comment(0)

-1

Just a small follow up.

Original:

"As far as I know when my non-enterprise distribution certificate expires I have to renew it. This expiration disables all apps signed with the expired certificate as soon as the devices checks the certificate's validity against Apple’s OCSP server."

This is not quite true, if I understand it correct. This info from Apple and as explained here says the opposite.

What happens if my certificate expires or has been revoked?

...

iOS Distribution Certificate (App Store)

If your iOS Developer Program membership is valid, your existing apps on the App Store will not be affected. However, you will no longer be able to submit new apps or updates to the App Store.

Broeder answered 19/9, 2013 at 21:52 Comment(3)

Hi Kost, you are right for App Store. The thing is that I expressed myself badly, I was talking about Ad Hoc distribution where Apple do not resign your app. (or do anything) – Hatching 20/9, 2013 at 11:42

Important to note that the rules are different for Enterprise and non Enterprise apps. – Aragonite 11/2, 2014 at 16:29

The question is related to Apple Developer Enterprise program, and not Apple developer program. Your answer is correct for Apple Developer program which is out of context for this question. – Chlorite 9/12, 2020 at 5:51

Hot tags

Godot Unity Godot Help Programming Godot 4.X GUI GDScript 3D 2D Physics CSharp Godot 3.X VR XR Projects C++

Recommended topics

Hot tags