An IPA that won't install is almost always a signature or configuration problem — rarely an actual broken binary. Here's the diagnostic order that solves the vast majority of cases.

1. Certificate expired or revoked

The single most common cause. If the IPA installed before and stopped working, the cert behind it has expired (Developer: every 7 days) or been revoked by Apple (Enterprise: anytime).

Fix: Re-sign with a fresh certificate.

2. Device UDID not in provisioning profile

For Developer-signed IPAs, the device's UDID must be explicitly registered in the profile. Common error: "Provisioning profile doesn't include device."

Fix: Add UDID, re-sign. Or switch to Enterprise signing which has no UDID restriction.

3. HTTPS requirement not met

If installing via itms-services install link, both the manifest plist and the IPA must be served over HTTPS. iOS silently rejects HTTP URLs.

Fix: Host on HTTPS or use a signing service's hosted link.

4. "Untrusted Developer" error

Common with Developer-signed apps. The certificate is valid but iOS hasn't been told to trust it.

Fix: See how to trust the developer profile. Settings → General → VPN & Device Management → tap the profile → Trust.

5. "Unable to Verify App"

iOS connected the device to Apple to verify the certificate and the check failed. Usually means no internet or revoke.

Fix: See our dedicated fix for "Unable to verify app".

6. Storage full

iOS pre-checks free space before installing. If you have less than ~2x the app size free, install silently fails or hangs.

Fix: Free up at least 1GB and retry.

7. iOS version too old for the IPA

The IPA's Info.plist declares minimum iOS version. If your device is below that, install fails.

Fix: Update iOS, or get a re-sign that lowers the minimum version (sometimes possible).

8. Bundle ID conflict with existing app

If another app with the same bundle ID is installed but was signed with a different cert, iOS may refuse to replace it.

Fix: Delete the old version, then install the new one. App data is lost — back up first.

9. Profile expired (even if cert is valid)

A provisioning profile has its own expiry independent of the certificate. If the profile expired but the cert hasn't, iOS still rejects.

Fix: Re-sign to generate a fresh profile.

10. App entitlements don't match the certificate

Some entitlements (push notifications, iCloud, NFC, Sign in with Apple) require specific certificate types. Mismatch = install or runtime failure.

Fix: Use a certificate that supports the entitlements, or re-sign and strip the unsupported entitlements.

Diagnostic order

Work through this checklist in order:

  1. Did it install before and stop? → cert expired/revoked (cause 1)
  2. Error mentions device or UDID? → cause 2
  3. Install link won't even prompt? → cause 3 (HTTPS) or revoke
  4. Installs but won't open with profile error? → cause 4 or 5
  5. Install hangs or fails with no error? → cause 6 or 7
  6. Trying to install over an existing app? → cause 8
  7. Everything else → causes 9, 10

If you've worked through this and still can't install, a fresh re-sign with a fully-rotated certificate fixes the long tail.