Xcode 6 beta 2 issue exporting .ipa: "Your account already has a valid iOS distribution certificate"

Question

I'm having trouble exporting an app for Ad Hoc Distribution on Xcode 6 beta 2:

When exporting my project for ad hoc development on Xcode 6, I receive this alert. I've tried exporting it on Xcode 5 and had no problems at all saving the .ipa. Is anyone experiencing this problem as well?

Solar

I suspect that your Xcode 6 Signing Identity in Build Setting is different from Xcode 5, can you provide more information there? – Gristly

Do you have multiple developer signing identities on your Mac? – Gristly

@christopher.ryan.cruz I have the same problem. I can still export with xcode5 on my mac, but getting the same error message trying with the new xcode6. Did you figure this out yet? – Alewife

@vladof I just checked, they are identical. – Alewife

Any luck solving this @Gal? – Shading

@Shading i wouldnt call this a solution- but a fix that worked for me. I deleted and re-downloaded all my required certificates along with the keys needed to generate and i was able to get past this. – Solar

@christopher.ryan.cruz that is the solution. Xcode is saying "There is no valid Distribution Certificate". Re-creating or re-downloading it should fix the problem. – Caulk

Just had this problem with the GM version of XCode6. :-{ – Asarum

@KendallHelmstetterGelner and how you solved it? I faced with same problem and tried to revoke certificates but without any result. – Ellanellard

I am also experiencing this as well. Anyone have a solution for the GM? – Excavation

@JohnTracid Unfortunately I did not solve it yet, I switched to XCode5 to complete my build. My plan is to sometime soon delete all distribution certificates from Keychain and see if that fixes the problem. – Asarum

@KendallHelmstetterGelner yes, I did the same. Looks like Xcode 6 not ready for use. – Ellanellard

@JohnTracid I couldn't solve this issue via Xcode 6 no matter what I did. But the CLI solution below from Chris Comeau did work for me.. – Consolation

I having this issue even with official xCode 6 release. Try revoke many time, delete from keychain, logout and login account in xcode again, but none of it bring me positive result! any help? – Mcgrody

You got this error because xCode try to create a new dist cert and adhoc provisioning profile while you already have a valid one. Apple has changed the way of Ad Hoc build. Now you can't make Ad Hoc distribution builds using dev cert. You should use a distribution cert with an "Ad Hoc" provisioning profile instead. – Dipstick

I recreate the distribution certificate and install it again to solved this problem. – Fictile

See: #25775476 – Expulsive

Answer 1

This is what worked for me.

1. On my machine I kept both Xcode 5 and Xcode 6 beta.

2. From Xcode 6 beta, Archive the project. Close Xcode 6.

3. Open Xcode 5, go to Organizer and export as Ad Hoc build with proper provisioning profile.

That's it!

Piccoloist

I'm having this happen on the GM. This is not going to be a valid solution much longer since Xcode 6 and iOS8 are releasing this week. – Excavation

On Xcode 6.0.1 the problem is gone. Apple has changed the way of Ad Hoc distribution for developers. Now you can't make Ad Hoc distribution builds using Development Certificate. You need a Distribution Certificate with "Ad Hoc" provisioning profile (not Development Provisioning profile) to make Ad Hoc builds. It's a real pain and you can no longer use one Apple Developer account on multiple Macs for Archiving TF (TestFlight) builds. Seems like every single developer should pay $99/yr individually! Apple's TestFlight sounds promising but beta builds will be reviewed by App Review Team. :( – Piccoloist

Later - after I revoked and regenerated all certificates and provisioning profile for the developer account in question, the problem was finally resolved. – Wallas

On Xcode 6.1 the problem is no more. But if you want to make Ad Hoc build for TestFlight (testflight.com) distribution you have to use Ad Hoc Distribution Provision. Development Provision won't let you Archive for Ad Hoc Distribution any more. Not a good approach by Apple. – Piccoloist

I am still having this problem in Xcode 6.1 and Xcode 5.1.1 is now showing a yellow warning triangle by all of my profiles when I try to export. This did not happen before I started building with Xcode 6.1. – Menhaden

No, the problem is still around in Xcode 6.1.1. (I assume you mean the original problem that the OP posted about.) – Ectoenzyme

In that case what is use of having developer certificate. Now onwards we should have "Distribution" certificates if we want to upload build into AppStore and make an .ipa file for internal testings. Even in code signing also we have to select "iPhone Distribution". @adnan – Varia

I tried this, but when I tried to install the app as an ad-hoc distribution, there was a code-signing error on the install. Eventually I had to import the developer profile from another machine, rename the app bundle to match the active certificate, and ensure the team name was correctly name on the "General" tab. – Blinking

Answer 2

I've had the same issue two days ago. Turns out the problem was:

1. I have my own developer distribution certificate with a proper private key
2. I have enterprise developer distribution certificate of my client without a private key
3. I try to make an enterprise distribution package for my client
4. Xcode throws at me vague error: Your account already has a valid iOS distribution certificate

The solution is: get a private key for enterprise account of my client. There are 2 possible options:

1. Ask you client for credentials to access his enterprise developer account on Apple website. Revoke old certificate and recreate it. You'll create the private key in the process. BEWARE: revoking an enterprise distribution certificate invalidates all apps that were signed and deployed with that certificate (official info).
2. Ask your client to export his private key from his Keychain Access application as a *.p12 file and send it to you with a password. You can't download the existing private key from the Apple website. The only way to get it is to ask your client. I did it and it and I was able to finally make the package.

How to find out if you have a private key for a certificate: Open Keychain Access application. Choose certificates. Find your certificate. If you see small grey triangle on the left side of the certificate, open it and you see your private key. No triangle = no private key.

Dialogist

I had this error today, totally stumped until I read your excellent answer. Thank you soo much! +1 – Rebozo

What a fantastic answer to an utterly impenetrable problem. – Orlan

@AlexanderVasenin I tried this but same issue exist still. Any solution came for this? – Dobruja

Answer 3

I had the same problem, I had to use the command line "xcodebuild" tool as a workaround, with only Xcode 6 installed (didn't have to re-install Xcode 5).

http://www.thecave.com/2014/09/16/using-xcodebuild-to-export-a-ipa-from-an-archive/

Example:

xcodebuild -exportArchive -archivePath $projectname.xcarchive -exportPath $projectname -exportFormat ipa -exportProvisioningProfile "Provisioning Profile Name"

Parlance

Thank you so much! That worked and got a adhoc build sent out. – Uranie

I was able to produce an *.ipa this way, but can't install it (app just hangs on 'Installing...'). Device log in Xcode shows code signing error. – Dialogist

In which folder path we can write this code to create ipa ? – Gujarati

This was the only solution that worked for me after trying and failing to remove and revoke certificates, keys, and profiles locally and in the developer portal for Xcode 6.1/iOS 8.1 – Mayce

I found the similar solution in great descriptive steps, it really very help full for beginners datacalculation.blogspot.in/2014/10/… – Disconsider

You are a life saver Chris! The link helped me to get a adhoc built...Thanks a lot! – Helgoland

I am not so good with the terminal. Where should I run the commands i.e. should I change directory? I get .xcodeproject does not exist. – Eddieeddina

When I tried doing this, I got a code signing error trying to install the .ipa on my device by dragging it into Xcode's Devices window. – Menhaden

I use Application Uploader to update the iPa file and get the No eligible software found. Make sure this software is owned by your developer organization. error. – Hemangioma

Answer 4

In my case, what solved the problem was deleting all Distribution Certificates from my Apple Developer Account. Then, Xcode managed to create development and distribution certificates again, and that did the trick.

Xever

Which also means you have to re-do all your ad-hoc distribution profiles. – Asarum

@Kendall, I didn't re-do all my ad-hoc distribution profiles. Just deleting the certificates from keychain and Apple developer portal. Then Xcode managed to solve all the issues on his own – Xever

This has worked for me as well... this has been a constant issue with every release of Xcode, and I really wish Apple would spend some time revamping this horrible process. – Fleeta

Works for me too (with Xcode Beta 6), just be sure to delete the certificates from The Apple developer website and keychain, then let Xcode fix the issue – Beberg

When you say you deleted all your distribution certificates, are you saying you deleted them from your computer and xcode re-installed them or are you saying you deleted them from the member portal and xcode created new ones in their stead? – Biforked

Deleting from my computer AND members portal – Xever

Answer 5

I get a solution without renew the certificate:

1 - Archive the target with the appropiate Code Signing Identity and Provisioning Profile

2 - Right button in the created file in Organizer --> Show in Finder

3 - Right button in the xcarchive file --> Show package content

4 - There, in Finder, go to Products/Applications/

5 - Upload the file Products/Applications/appName to iTunes

6 - When the app appear in iTunes, right click on it --> Show in Finder. This is the ipa file

7 - Send this ipa through App Loader 3.0

I dont think that it is a lasting solution but do not want to delete my certificates

Swound

plz why should we use app loader here? i don't know really about it. – Copyholder

What are the "appropriate" Code Signing Identity and Provisioning Profile? I've tried setting the Release Code Signing Identity to "iOS Distribution" and it didn't help. If I set the Release Provisioning Profile to anything other than "Automatic" Xcode screws up the Code Signing Identity. – Menhaden

Answer 6

FINALLY SOLVED IT!!

1) Create a NEW production certificate through developer.apple.com which requires you to use Keychain Access to create a new private key on your computer

2) In the same developer portal, open your distribution Provisioning Profile used with this app and select the new production certificate which you just created. Generate the provision then download it and run it

3) Run your app, Archive it, then export the archive.

viola

This took me days if not weeks to figure out, I hope it helps you.

Biforked

Looks like your "voilà" got autocorrected; it's not enough of a change for Stack Overflow to let me edit. – Brubeck

Answer 7

Create new iOS Distributon Certificate and choose Production> App Store & AdHoc section. Also don't forget to change Target>Build Settings> Code Signing all to iOS Distribution.(but after created ipa set it back to iOS Developer) Only this solved my problem.

Micamicaela

That option is greyed out. What am I missing? – Menhaden

#17444586 this may help you. – Micamicaela

Answer 8

I faced the same issue today with Xcode 6.1.1

When I tried to add iOS Distribution certificate via Xcode the error I got was the same. There were already several issued distribution certificates in Member Center and I did not want to invalidate them because if they are used for Ad Hoc distribution in an Enterprise environment this would also invalidate the applications that are installed on the devices (at least this is what I've read).

What I did was:
1. Through Keychain Access generated a request for a certificate from a certification authority. And saved the request to a file;
2. Logged in to Member Center certificates area Production section and requested a new "App Store and Ad Hoc" production certificate, this requested the file from step 1;
3. Downloaded the new certificate and when imported in Keychain Access it now had a private key.

Afterwords I cleaned Xcode, restarted it, checked that in my account the profile is visible and built a new Archive. And now I was able to validate the archive.

Now if I try to request a new "App Store and Ad Hoc" certificate this option is grayed out for me and I suppose this is because my account already has the certificate issued. If this is your case you will most probably need to invalidate your previous certificate before you can issue a new one. This is why Apple recommend backing up your certificate. But it is very likely that you will not need to invalidate all production certificates as I already have a number of those in the profile.

Hope this helps someone :)

Contribute

Thanks for the info, Angel. I have Xcode 6.1.1 and I already tried this yesterday and today but I must have got one fragile step wrong because I'm still unable to validate my archive. (FYI, the reason you have that option grayed out, according to what I read elsewhere in SO, is that you have two production certs already and that's apparently Apple's secret limit) – Ectoenzyme

Do you seen the private key for the Distribution certificate through Keychain Access. In case see it you could try: 1. Delete all archives that you have in Organizer for this project. 2. Before you build your archive make sure that you have selected your project target and the target device is a real device, not a simulator. 3. Do a "Clean Build Folder" through Xcode's Product menu this is the same option as Clean but you need to hold the Alt key. 4. Run you project on the actual device and make sure all is correct. 5 Create your archive. 6. Try validating it. – Contribute

But if you do not see the private key you will not be able to validate as you could not sign the package. Yesterday we tried this process with a colleague of mine and I had to export my private key through Xcode Account with selected iOS Distribution. Then we imported it through Keychain Access and he was able to validate and upload builds to iTunes Connect. To me what I needed to get about this process is that you really need the 2 certificates: iOS Development and iOS Distribution. They are used in different cases and for iTunes Connect you need the Distribution one :) – Contribute

Thanks, Angel. I finally figured out which cert was missing the private key, deleted every single cert and profile from Xcode > Accounts and Dev Center, then started fresh. The process is way too fragile, and supposedly having two developer accounts on the same Mac seems to play a partial factor in the problems. – Ectoenzyme

Nice to hear you figured this out! – Contribute

Answer 9

Apple has changed the way of Ad Hoc build. Now you can't make Ad Hoc distribution builds using dev cert. You should use a distribution cert with an "Ad Hoc" provisioning profile instead.

Dipstick

Do you have a documentation link for this? – Doggo

You can try yourself by removing all cert and profile and let XCode take the rest, you will see it automatically create distribution cert and ad-hoc provisioning profile. – Dipstick

I did, thanks. Was just wondering if Apple had actually announced it anywhere or just left us to figure it out. – Doggo

Answer 10

I believe the actual reason you ended up in this screen is while trying to get the .ipa file to be distributed to your testers and clients. In Xcode 6, to get the .ipa file you may use the old method for iPA generation:

1. Select organiser in Xcode. In the Archives tab select the Archive whose iPA file you need to generate.
2. Right click and select option “Show in Finder”
3. You will see the .xarchive file. Right click and select “Show Package Contents”
4. You will see folders: dSYMs, Info.plist and Products.
5. Open Products>Applications and you will see your .app file.
6. Drag and drop this .app file to iTunes in Mac.
7. Your .app file will be listed under "My Apps" in iTunes.
8. Right click on your application and select “Show in Finder”.

Now you have the .ipa file which you can send to your testers for testing. Hope this helps.

Traumatize

Answer 11

There has been changes in way apple manages our private and public key. The previous method to share account on two machine was
1.download provisioning
2.export/checkout certificate

install them both on the other mac

but now you dont have to do that you export your entire account.
1.XCode -> preferences -> account (select account) on bottom left there is option to export that you will be prompted to give a password give any it will be required while importing on other system.A .developerprofile file will be downloaded on location of your choice.

2.download it on other mac and when you see the prompt your device already have valid signing identity click on import Developer Profile and import this .developerprofile file. enter password when prompted.

got help from here

Cuzco

@Ranjit then clear everthing and make new certificates – Cuzco

Answer 12

I resolved it following the next steps:

1)in your apple developer account: Create a new Production Certificate Choose the App Store and Ad Hoc Option

2)in your apple developer account: Create a new provisioning profile with you current bundle id and the certificate created in the step one

3)in your xcode:

• Select your target
• In the tab Build Settings in the zone Code Signing
• In the sub-zone Code Signing Identity - Release
• Set your new distribution certificate (ad hoc)
• In the Provisioning Profile - set your new provisioning profile (ad hoc)

Seems that xcode 6 now requires an ad hoc distribution certificate in order to export your IPA.

Spiny

Answer 13

I got the same issue today, and found a good solution I think.

First of all, there're something unnormal:

the normal is:

and in the keychain:

the normal is:

then, I realize that I lack the the correct provisioning profile which contains the correct iOS Distribution certificate.

Finally, my solution is: use my CertificateSigningRequest.certSigningRequest file to generate a new iOS distribution certificate, and use the new iOS distribution certificate to generate a new provisioning profile.

Note, I don't delete the old certification and provisioning profile, because my colleague works well with them. Does this affect the apps I already published? The answer is NO. I just change the code signing certificate, and some important certificate like push notification certificate is ties with app ID:

So don't worry about that.

Hope the above is helpful.

Hemangioma

Answer 14

As pointed out by a commenter this has proven to be a solution for myself and others:

I deleted and re-downloaded all my required certificates along with the keys needed to generate and i was able to get past this error

Solar

How did you delete all your certificates? i removed them from keychain, but still having the same issue. – Xever

did you re-download the certificates and make sure they had keys in the certificates @lucas? – Solar

yes, i did it almost 20 times and still have the same problem. I removed all my certificates, provisioning profiles, previous archived apps, and still have the "Your account already has a valid iOS distribution certificate" – Xever

by doing this way, actually you give xCode permission to auto create and use an ad-hoc provisioning profile, check your apple dev program, you will see that adhoc profile. – Dipstick

Answer 15

I revoke my producion certificates, and request another one, solve this problem. Maybe you need restart your xcode.

Sevigny

This worked for me. Ironically, the production certificate had its private key in my keychain, and was still valid!! – Thach

Answer 16

I just encountered this after upgrading from Xcode 5 to 6.

In my case creating a new production certificate and then recreating the distribution provisioning profile for my app did the trick.

Gangster

Answer 17

In the official latest Xcode 6.0, this will happen if you accidentally created a record in your entitlements file that has a key like this:

com.apple.security.application-groups

I am not sure if Xcode automatically created it by default. But deleting that key solved my problem. I didn't have to recreate any certificates. It was not my problem.

Wenonawenonah

Where do you found this file allocate? – Mcgrody

It is the plist file named: PRODUCT_NAME.entitlements (it was created by Xcode by default) – Wenonawenonah

com.apple.security.application-groups gets turned ON if you enable app group from Capabilities. If you create a new target for developing app extension it's automatically included. – Piccoloist

Answer 18

I solved this by simply regenerating the provisioning profile on the developer portal (in my case an App Store profile) and adding to my computer via iPhone Configuration Utility. I didn't want to mess with the certificates and successfully avoided that.

I noticed this error message logged from Xcode in my console:

None of the valid provisioning profiles allowed the specified entitlements: application-identifier, beta-reports-active, keychain-access-groups.

After downloading a the new provisioning profile, the missing beta-reports-active = true was present and Xcode signed the build.

Pragmatism

Answer 19

My Solution was Delete the only iOS Production Certificate which I'm using and create it again. Doing this, you must create a new Provisioning profile assigning the certificate just created.

then I did the process of Archive again and works!

Kunming

Answer 20

Additionally I found that Xcode Accounts come into play -

It turned out that I did have a valid distribution certificate on my personal account (mobilology) so I deleted that account temporarily from the Accounts section (you may wish to leave only that account that you are distributing from).

Suddenly the signing / archiving process worked!

Gert

Answer 21

Step1:-Login to your apple developer account

Step2:-Choose Certificates

Step3:-Delete if there are more than one distribution certificates

Step4:-Then retry archiving ( if error still exist, revoke all certificates and create new distribution certificate and edit your provision profiles.)

Allegra

Answer 22

I think its a bug from Xcode. to make it work, i need delete the actual distribution provisional profile and i had to make a new provisional distribution profile from devcenter. This works from me

Khalkha

Answer 23

I also faced the same problem, i was using development certificate instead of Adhoc. Issue is fixed after using Adhoc certificate.

Microminiaturization

Answer 24

Delete you ios Distribution certificate from the apple developer site and regenrate the ios Distribution with the certSignReq file. Works for me always. Your other apps wouldnt be affected . Atleast in my case it never did.

Rustice

Answer 25

In my case I generated a new distribution profile and added it to XCode, then tried to submit the build. Turns out, all I had to do to get rid of this message is restart XCode and attempt again to submit. Worked.

Homoeo

Answer 26

In my case, I got the error message when trying to export and AdHoc build from Organizer. I did two things, either of which may have fixed the issue:

1) Exported the existing certificate it claimed I did not have from my keychain, deleted it from keychain, re-imported.

2) Created an ad-hoc distribution certificate, refreshed XCode account to obtain the new distribution provisioning profile.

After that I was able to export the exact same archive to an AdHoc build. I really think it was only that fact I was missing an ad-hoc distribution that targeted that specifc bundleID that led to XCode being confused.

Followup: The archive I had created before did not work, I had to re-generate it. A clue this was an issue was that when selecting the archive and opting to export an Ad-Hoc build, the default account selected was the wrong account for the build (the project had no default account selected when I archived the build).

Asarum

Answer 27

This is what worked for me (Enterprise Account)

Import the developer profile from the other machine, which loaded the certificate I needed with the secret key.
Rename the app bundle to the enterprise name (it was named under the app store name).
Change the team name in the "General" tab to my company's team - it was defaulting to my personal developer account!

With these changes, I could export an ipa as both ad-hoc and enterprise, upload it to Hockey Rink, and download it on my phone

Blinking