Step-by-Step Guide: Resigning IPA Files for Distribution

You have a perfectly good IPA file, but it's refusing to install. Maybe the certificate expired, or maybe you forgot to add a new tester's UDID.

Instead of rebuilding the entire project from Xcode (which might take hours or require source code you don't have handy), you can just resign the IPA. This guide walks you through the process of swapping out the signature and provisioning profile of an existing iOS app.

Prerequisites

• A macOS computer (required for standard tools).
• The .ipa file you want to resign.
• A valid Distribution Certificate (installed in Keychain).
• A matching Provisioning Profile (.mobileprovision).

Before you start: inspect the IPA

Resigning fails silently when the new profile doesn't match the binary, so check what you're working with first. Confirm the app isn't App Store (FairPlay) encrypted, read the current bundle ID and entitlements, and note which capabilities the app declares. From the command line:

# Dump the entitlements the binary expects
codesign -d --entitlements :- Payload/App.app

# Read the embedded provisioning profile
security cms -D -i Payload/App.app/embedded.mobileprovision

If you're not on a Mac, drop the file into BetaDrop's IPA Inspector to read the bundle ID, provisioning profile, entitlements, and expiry in the browser. Adding testers by Ad Hoc? Their device UDIDs must be baked into the new profile first — grab each one with the UDID checker (Ad Hoc profiles are capped at 100 devices per device type per membership year).

Method 1: Using Fastlane (Recommended)

If you have fastlane installed (and you should), this is the easiest CLI method.

fastlane sigh resign ./path/to/app.ipa \
  --signing_identity "Apple Distribution: Your Company (ID)" \
  --provisioning_profile ./path/to/profile.mobileprovision

Fastlane automatically handles expanding the IPA, replacing the profile, resigning the binary, and zipping it back up.

Method 2: iOS App Signer (GUI)

If you prefer a visual interface, "iOS App Signer" is an excellent open-source tool.

1. Download iOS App Signer from GitHub.
2. Open the app.
3. Input File: Browse and select your IPA.
4. Signing Certificate: Select your valid certificate from the dropdown.
5. Provisioning Profile: Select your new profile (or choose "Re-Sign Only" if just updating cert).
6. Click Start.
7. Save your new IPA.

Method 3: Terminal (The Hard Way)

For those who want to understand exactly what's happening under the hood:

1. Unzip the IPA: unzip App.ipa
2. Remove old signature: rm -rf Payload/App.app/_CodeSignature
3. Replace profile: cp new.mobileprovision Payload/App.app/embedded.mobileprovision
4. Extract the profile's entitlements to a file so you can pass them explicitly: security cms -D -i new.mobileprovision > profile.plist, then /usr/libexec/PlistBuddy -x -c 'Print :Entitlements' profile.plist > entitlements.plist
5. Sign the nested code first, because codesign signs only the path you give it. Each framework and dylib: for f in Payload/App.app/Frameworks/*; do codesign -f -s "Certificate Name" "$f"; done. Each app extension in Payload/App.app/PlugIns/ needs its own matching profile copied in as embedded.mobileprovision and its own entitlements: codesign -f -s "Certificate Name" --entitlements ext-entitlements.plist Payload/App.app/PlugIns/Ext.appex
6. Then sign the outer app last: codesign -f -s "Certificate Name" --entitlements entitlements.plist Payload/App.app
7. Zip it back: zip -qr Resigned.ipa Payload
8. Verify the result: codesign --verify --deep --strict Payload/App.app

Common Pitfalls

Entitlement Mismatches

The most common error. If your original app was built with "Push Notifications" entitlement but your new mobileprovision doesn't have it, the resign will technically succeed, but the app will crash on launch.

Keychain Issues

Ensure the specific private key for your signing certificate is present in your Keychain. Having the public certificate is not enough — in Keychain Access, the certificate should show a disclosure triangle with a matching private key underneath. That key should never leave your machine, either — it's the reason signing an IPA online is a bad idea.

Untrusted developer on the device

If you re-signed with an enterprise (in-house) certificate, the first launch shows “Untrusted Enterprise Developer”. On the tester's iPhone, open Settings → General → VPN & Device Management, tap the organization, and choose Trust, then Allow & Restart on iOS 18 and later and finish the prompts after the restart; it is needed once per device and certificate. Ad Hoc builds skip this step entirely and launch straight away on a device listed in the profile. Development-signed builds from a paid team need no trust step either, though a build signed with a free Personal Team does, under DEVELOPER APP on that same screen; and iOS 16 and later asks for Developer Mode (Settings → Privacy & Security) before it runs any development-signed build.

Distribute the resigned build over the air

A resigned IPA still has to reach testers, and emailing a file or plugging in a cable is slow. Host it over HTTPS with a manifest.plist and an itms-services link, or skip the manifest plumbing entirely: upload the build to BetaDrop’s IPA file installer and it returns an instant OTA install link plus a QR code, so testers install straight from their phone browser — no TestFlight, no App Store, and no tester accounts. For the mechanics of the install flow, see our guide to installing IPA files over the air.

Frequently Asked Questions

Why would I need to resign an IPA?

Common reasons include: the original signing certificate expired, you need to add new device UDIDs to an Ad Hoc provisioning profile, you want to change the distribution method (for example from Ad Hoc to Enterprise), or a partner handed you a finished build without the source code. Resigning swaps the certificate and profile without rebuilding from Xcode.

Can I resign an App Store IPA?

No. IPAs downloaded from the App Store are FairPlay-encrypted (DRM) and cannot be resigned or installed on other devices. You can only resign IPAs you built yourself or unencrypted Development, Ad Hoc, or Enterprise builds.

Do I need a Mac to resign iOS apps?

In practice, yes. Resigning relies on Apple's codesign tool, which ships with macOS, and the signing certificate's private key must live in Keychain Access. Some cloud services and Linux ports exist, but they are less reliable, so a Mac is the dependable route.

What happens if resigning fails?

The app either fails to install or crashes immediately on launch. The usual cause is an entitlements mismatch: the binary requests a capability such as Push Notifications or App Groups, but the new provisioning profile does not grant it. Compare the profile against the app before you resign.

How do I check what certificate and entitlements an IPA already has?

Run codesign -d --entitlements :- Payload/App.app to dump the current entitlements, and security cms -D -i embedded.mobileprovision to read the embedded profile. You can also drop the file into BetaDrop's IPA Inspector to read the bundle ID, provisioning profile, and entitlements in your browser without a Mac.

How do I get a resigned IPA onto a tester's device?

Host the resigned IPA over HTTPS with a manifest.plist and share an itms-services install link, or upload it to an over-the-air distribution service that generates the link and QR code for you. The tester opens the link in Safari and installs the build; for an enterprise-signed build they also trust the certificate once under Settings > General > VPN & Device Management. Ad Hoc builds need no trust step.

Summary

Resigning is a vital skill for iOS release managers. It lets you fix expiration issues and add testers without touching the source code — inspect the build to confirm the profile and entitlements match, resign it, then distribute it over the air.