Step-by-Step Guide: Resigning IPA Files for Distribution

You have a perfectly good IPA file, but it's refusing to install. Maybe the certificate expired, or maybe you forgot to add a new tester's UDID.

Instead of rebuilding the entire project from Xcode (which might take hours or require source code you don't have handy), you can just resign the IPA. This guide walks you through the process of swapping out the signature and provisioning profile of an existing iOS app.

Prerequisites

• A macOS computer (required for standard tools).
• The .ipa file you want to resign.
• A valid Distribution Certificate (installed in Keychain).
• A matching Provisioning Profile (.mobileprovision).

Before you start: inspect the IPA

Resigning fails silently when the new profile doesn't match the binary, so check what you're working with first. Confirm the app isn't App Store (FairPlay) encrypted, read the current bundle ID and entitlements, and note which capabilities the app declares. From the command line:

# Dump the entitlements the binary expects codesign -d --entitlements :- Payload/App.app # Read the embedded provisioning profile security cms -D -i Payload/App.app/embedded.mobileprovision

If you're not on a Mac, drop the file into BetaDrop's IPA Inspector to read the bundle ID, signing certificate, provisioning profile, entitlements, and expiry in the browser. Adding testers by Ad Hoc? Their device UDIDs must be baked into the new profile first — grab each one with the UDID checker (Ad Hoc profiles are capped at 100 devices per device type per membership year).

Method 1: Using Fastlane (Recommended)

If you have fastlane installed (and you should), this is the easiest CLI method.

fastlane sigh resign ./path/to/app.ipa \ --signing_identity "Apple Distribution: Your Company (ID)" \ --provisioning_profile ./path/to/profile.mobileprovision

Fastlane automatically handles expanding the IPA, replacing the profile, resigning the binary, and zipping it back up.

Method 2: iOS App Signer (GUI)

If you prefer a visual interface, "iOS App Signer" is an excellent open-source tool.

1. Download iOS App Signer from GitHub.
2. Open the app.
3. Input File: Browse and select your IPA.
4. Signing Certificate: Select your valid certificate from the dropdown.
5. Provisioning Profile: Select your new profile (or choose "Re-Sign Only" if just updating cert).
6. Click Start.
7. Save your new IPA.

Method 3: Terminal (The Hard Way)

For those who want to understand exactly what's happening under the hood:

1. Unzip the IPA: unzip App.ipa
2. Remove old signature: rm -rf Payload/App.app/_CodeSignature
3. Replace profile: cp new.mobileprovision Payload/App.app/embedded.mobileprovision
4. Extract the profile's entitlements to a file so you can pass them explicitly: security cms -D -i new.mobileprovision > profile.plist, then /usr/libexec/PlistBuddy -x -c 'Print :Entitlements' profile.plist > entitlements.plist
5. Resign every nested binary (frameworks and app extensions must be signed before the outer .app): codesign -f -s "Certificate Name" --entitlements entitlements.plist Payload/App.app
6. Zip it back: zip -qr Resigned.ipa Payload
7. Verify the result: codesign --verify --deep --strict Payload/App.app

Common Pitfalls

Entitlement Mismatches

The most common error. If your original app was built with "Push Notifications" entitlement but your new mobileprovision doesn't have it, the resign will technically succeed, but the app will crash on launch.

Keychain Issues

Ensure the specific private key for your signing certificate is present in your Keychain. Having the public certificate is not enough — in Keychain Access, the certificate should show a disclosure triangle with a matching private key underneath.

Untrusted developer on the device

After a resigned build installs, the first launch may show “Untrusted Developer”. On the tester's iPhone, open Settings → General → VPN & Device Management, tap the developer certificate, and choose Trust. This step is unavoidable for Ad Hoc and Development signing; only App Store and TestFlight builds skip it.

Distribute the resigned build over the air

A resigned IPA still has to reach testers, and emailing a file or plugging in a cable is slow. Host it over HTTPS with a manifest.plist and an itms-services link, or skip the manifest plumbing entirely: upload the build to BetaDrop and it returns an instant OTA install link plus a QR code, so testers install straight from their phone browser — no TestFlight, no App Store, and no tester accounts. For the mechanics of the install flow, see our guide to installing IPA files over the air.

Frequently Asked Questions

Why would I need to resign an IPA?

Common reasons include: the original signing certificate expired, you need to add new device UDIDs to an Ad Hoc provisioning profile, you want to change the distribution method (for example from Ad Hoc to Enterprise), or a partner handed you a finished build without the source code. Resigning swaps the certificate and profile without rebuilding from Xcode.

Can I resign an App Store IPA?

No. IPAs downloaded from the App Store are FairPlay-encrypted (DRM) and cannot be resigned or installed on other devices. You can only resign IPAs you built yourself or unencrypted Development, Ad Hoc, or Enterprise builds.

Do I need a Mac to resign iOS apps?

In practice, yes. Resigning relies on Apple's codesign tool, which ships with macOS, and the signing certificate's private key must live in Keychain Access. Some cloud services and Linux ports exist, but they are less reliable, so a Mac is the dependable route.

What happens if resigning fails?

The app either fails to install or crashes immediately on launch. The usual cause is an entitlements mismatch: the binary requests a capability such as Push Notifications or App Groups, but the new provisioning profile does not grant it. Compare the profile against the app before you resign.

How do I check what certificate and entitlements an IPA already has?

Run codesign -d --entitlements :- Payload/App.app to dump the current entitlements, and security cms -D -i embedded.mobileprovision to read the embedded profile. You can also drop the file into BetaDrop's IPA Inspector to read the bundle ID, signing certificate, provisioning profile, and entitlements in your browser without a Mac.

How do I get a resigned IPA onto a tester's device?

Host the resigned IPA over HTTPS with a manifest.plist and share an itms-services install link, or upload it to an over-the-air distribution service that generates the link and QR code for you. The tester opens the link in Safari, installs the build, and trusts the certificate under Settings > General > VPN & Device Management.

Summary

Resigning is a vital skill for iOS release managers. It lets you fix expiration issues and add testers without touching the source code — inspect the build to confirm the certificate and entitlements match, resign it, then distribute it over the air.