P12 files, certificates and provisioning profiles
Learn which signing files belong together and why mixing them produces misleading errors.
The most common manual-signing mistake is treating the P12 and provisioning profile as independent files. They are a pair.
P12 identity
A .p12 or .pfx file normally contains a signing certificate and its private key. The password protects access to that private key. Anyone who obtains a working P12, its password and a compatible profile may be able to sign applications as that identity, so do not upload it to random diagnostic sites.
Provisioning profile
A .mobileprovision file is a signed Apple property list. Depending on its type, it identifies:
- the development team;
- the App ID or bundle-ID pattern;
- authorised signing certificates;
- enabled entitlements;
- registered device UDIDs;
- creation and expiry dates.
Apple's documented manual flow requires an App ID, certificate and registered devices before generating a development profile. Apple's profile creation guide is the baseline.
The pairing rule
Use the P12 and profile delivered as a matching set. If you receive separate Development and Distribution folders:
- pair the Distribution P12 with its Distribution profile;
- pair the Development P12 with its Development profile;
- do not select whichever profile has the later expiry without checking compatibility.
A signer may accept mismatched files initially and fail only while signing or installing. “Provision mismatch,” “invalid certificate,” and generic integrity failures can all begin here.
Password confusion
There can be two unrelated passwords:
- an archive or download password, used to open a ZIP;
- the P12 import password, used to decrypt the signing identity.
If importing the P12 reports an incorrect password, confirm that you extracted the ZIP and selected the actual .p12 file. Do not try to import the ZIP itself and do not assume the download password is the P12 password.
Safe storage
- Keep an offline backup of the original pair and password.
- Do not post either file in a public support channel.
- Do not send the files merely to prove that an error exists; begin with non-sensitive metadata.
- Remove signing identities from a tool you no longer trust.
- Remember that encryption on a provider's server does not protect the files after you download and expose them to another signer.