Apple Distribution Certificate: The Three Types and When to Use Each
When people say "Apple Distribution certificate" they usually mean one of three different things. Each is issued by Apple's developer portal but each is built for a different distribution model with very different rules.
1. App Store Distribution certificate
This is what every developer uses to publish to the App Store. It signs the IPA Apple receives during a submission. Once approved, Apple re-signs the binary with its own certificate before serving it to users — so the developer cert isn't what users actually run.
- Source: Apple Developer Program ($99/year)
- Where it installs: only via App Store
- Use case: shipping a public app
2. Ad-Hoc Distribution certificate
Ad-Hoc is the in-between option: same paid Developer Program, same cert technology, but the app installs directly on registered devices (max 100 per device class per year) without going through the App Store.
- Source: Apple Developer Program ($99/year)
- Where it installs: up to 100 registered UDIDs
- Use case: beta testing, client demos, regulated distributions
This is what services typically mean when they offer a "Developer signing" package. Each device must be registered by UDID, and the user installs via an OTA link.
3. Enterprise (In-House) Distribution certificate
The Apple Developer Enterprise Program is a separate, more expensive, harder-to-get program designed for companies distributing internal apps to their employees. Its certificate signs apps for unlimited devices, no UDID registration, no Apple ID prompts.
- Source: Apple Developer Enterprise Program ($299/year, requires D-U-N-S, 100+ employees, manual Apple review)
- Where it installs: any iOS device — globally
- Use case: in-house apps for employees (per Apple's terms)
- Risk: Apple actively revokes certs they detect being used for public distribution
Full detail: Apple Enterprise Certificate Explained.
Which one do you need?
| Goal | Right certificate |
|---|---|
| Ship to App Store | App Store |
| Beta test on <100 devices | Ad-Hoc |
| Distribute to large/unknown audience outside App Store | Enterprise |
| Personal testing only | Free Apple ID provisioning (no cert purchase) |
How signing services use these
Most signing services maintain a pool of Enterprise certificates for unlimited-device packages and Ad-Hoc / Development certs for single-device packages. The customer pays for one signing event; the service holds the actual cert. See our Developer vs Enterprise comparison for which makes sense for which use case.