Every iOS app you've ever installed went through Apple's code signing system. It's why you can't just download an arbitrary .ipa and run it — and also why "expired certificate" errors are so common. Here's how the system actually works.

The three pieces involved

Apple's code signing chain has three pieces. All three must be valid for an app to launch:

  1. A certificate — proves the signer is enrolled with Apple. Developer certs for testing, Distribution certs for production, Enterprise certs for in-house. (More: Apple Distribution certificates.)
  2. A provisioning profile — pairs a certificate with specific devices, app IDs, and entitlements.
  3. The signature itself — a cryptographic hash of every file in the app bundle, encrypted with the certificate's private key.

What "signing" actually does

The codesign tool (or Xcode, under the hood) does this:

  1. Calculates a SHA-256 hash of every file inside the .app bundle
  2. Stores those hashes in _CodeSignature/CodeResources
  3. Encrypts a master hash with the private key matching your certificate
  4. Embeds the provisioning profile as embedded.mobileprovision

When iOS receives the IPA, it does the reverse: validates the certificate against Apple's root, checks every hash, and confirms the device is allowed by the profile. Any mismatch and the app refuses to launch.

Why signatures break

The most common breakage modes:

  • Certificate expired or revoked — Developer certs expire after 7 days; Enterprise certs can be revoked by Apple anytime. See: recovery guide.
  • Device not in profile — Developer-signed apps only run on UDIDs explicitly listed. See: how to find your UDID.
  • App modified after signing — even renaming a single file in the bundle invalidates the signature.
  • Wrong entitlements — some features (push notifications, iCloud) need entitlements embedded in the profile and matching the certificate.

Re-signing: replacing a broken signature

A common operation is "re-signing" — stripping an old signature off an existing IPA and replacing it with a fresh one. The IPA binary doesn't change; only the wrapper does. This is what every IPA signing service does. See: how re-signing works.

What free Apple ID provisioning is

If you have any Apple ID, Xcode lets you sign apps for your own device without paying for the Developer Program. It works — but the resulting certificate is valid for only 7 days, you're limited to 3 apps simultaneously, and entitlements are restricted. This is what AltStore and SideStore use to re-sign apps every week. See: AltStore guide.

Enterprise signing: the exception

An Enterprise certificate issues provisioning profiles that bypass device registration entirely — any iOS device can install an Enterprise-signed app, no UDID needed, no Apple ID prompts. The tradeoff is revoke risk: Apple monitors Enterprise certs and revokes them aggressively if they detect public distribution.

TL;DR

Code signing is a three-piece chain (certificate + profile + signature) where any broken link kills the app. For one-off testing, free Apple ID provisioning is enough. For real distribution, you need a paid Apple program — or a signing service that holds one for you.