If a previously-working iOS app suddenly stops launching — "Untrusted Developer", "Unable to verify app", or it simply crashes on tap — the certificate that signed it has either expired or been revoked. The fix is called re-signing.

What re-signing actually does

An IPA file is a ZIP archive containing the compiled app plus a cryptographic signature. The signature ties the app to a specific Apple certificate. When the certificate expires (Developer: 7 days) or Apple revokes it (Enterprise: anytime), iOS refuses to launch the app.

Re-signing means:

  1. Stripping the old signature out of the IPA
  2. Generating a new provisioning profile with a current, valid certificate
  3. Signing the IPA again with the new credentials (full process: iOS code signing explained)
  4. Repacking it as a new .ipa file

The app code itself doesn't change. Only the signature wrapper does.

When you need to re-sign

  • Developer certificate expired — happens every 7 days like clockwork.
  • Enterprise certificate revoked — Apple killed the cert. Symptom: app stops working for everyone simultaneously.
  • Adding new devices — Developer-signed apps need the device UDID in the profile. Re-sign with the expanded device list.
  • Changing bundle ID or entitlements — modifying the app's identity requires a fresh signature.

Do you lose your app data when you re-sign?

It depends on whether the new signature keeps the same bundle identifier. If yes, the user can install the re-signed IPA over the old one and all app data stays intact. If the bundle ID changes, iOS treats it as a completely new app — old data is unreachable.

Reputable signing services preserve the bundle ID by default, so re-signing is non-destructive.

Re-signing on your own vs using a service

Technically you can re-sign an IPA yourself if you have:

  • A Mac with Xcode installed
  • A valid Apple Developer account ($99/year)
  • Either codesign from the command line or a tool like iOS App Signer

For a single re-sign, this is a multi-hour rabbit hole. For ongoing use, services that automate the process and rotate certificates are dramatically faster — turnaround is usually a few minutes per re-sign. See: how to compare signing services.

How long does a re-sign last?

Same as a fresh signing: 7 days for Developer, indefinite (until revoke) for Enterprise. Plan accordingly — if you're going to need this every week, an Enterprise sign avoids the maintenance entirely.

Need a re-sign right now? It's available as a $5 add-on to any existing order, or as a standalone service.