If you've ever heard of "sideloading" an iOS app or seen an app install directly from a website without going through the App Store, there's a good chance an Apple Enterprise certificate made it happen.

What is an Apple Enterprise certificate?

An Apple Enterprise certificate (officially the Apple Distribution Certificate issued via the Apple Developer Enterprise Program) is a credential that lets an organization sign iOS apps for in-house distribution — meaning their employees can install the app on company devices without going through the App Store. It's one of three Apple Distribution certificate types.

Unlike a regular Developer certificate, an Enterprise-signed app:

  • Installs on unlimited devices
  • Requires no Apple ID on the device
  • Requires no UDID registration
  • Installs with a single tap on an install link or .ipa download

Who can get one?

Officially: legitimate businesses with 100+ employees, a registered company name, and a D-U-N-S number. The application requires manual review by Apple. In 2026, Apple has become significantly stricter — most new applications are rejected, and Apple actively monitors how certificates are used.

The revoke risk

This is the critical part. An Enterprise certificate is valid until Apple revokes it. Apple revokes certificates when they detect:

  • Distribution outside the organization that holds the certificate
  • Apps that violate App Store guidelines (gambling, adult content, etc.)
  • High install volume from unrelated geographies
  • Certificate sharing or resale

When a revoke happens, every app signed with that certificate stops launching immediately — sometimes within minutes, sometimes after a few hours. There's no warning. This is why reputable signing services rotate certificates frequently and offer re-signing if a revoke happens. Full detail: recovery from a cert revoke.

How an Enterprise-signed IPA installs

The installation flow uses the itms-services protocol:

  1. The user taps an install link (an itms-services:// URL).
  2. iOS downloads the IPA + provisioning profile.
  3. The user goes to Settings → General → VPN & Device Management and trusts the developer.
  4. The app appears on the home screen and launches normally.

No Xcode, no developer account, no jailbreak.

Enterprise vs Developer certificate — the short version

Enterprise = unlimited devices, no Apple ID, but revoke risk. Developer = one Apple ID + registered devices, 7-day validity, no revoke risk. Pick based on your distribution scale and risk tolerance. Full comparison: Developer vs Enterprise.

If you need an Enterprise-signed IPA without going through the months-long process of applying for the Enterprise program (and getting rejected), a signing service is the practical route.