Inspect an IPA and provisioning profile

Inspect copies of files and avoid uploading private signing material to a checker website. These commands are read-only.

Without a computer, the certificate checker reads the same fields in the browser. The P12 is not uploaded; only the public certificate is sent for the revocation check.

List an IPA

unzip -l Example.ipa | less

Look for one expected Payload/*.app, then inspect Frameworks, PlugIns, Info.plist, embedded.mobileprovision, and _CodeSignature.

Test archive integrity:

unzip -t Example.ipa

Calculate a SHA-256 hash:

shasum -a 256 Example.ipa

On Linux, sha256sum Example.ipa provides the equivalent digest.

Decode a provisioning profile on macOS

security cms -D -i cert.mobileprovision > profile.plist
plutil -p profile.plist

Inspect ExpirationDate, ProvisionedDevices, TeamIdentifier, ApplicationIdentifierPrefix, Entitlements, and the embedded developer certificates.

Decode with OpenSSL

openssl cms -verify \
  -inform DER \
  -noverify \
  -in cert.mobileprovision \
  -out profile.plist

-noverify extracts the signed content and verifies message integrity without validating the certificate chain. Do not describe that command as full Apple-chain verification.

Inspect a P12 without exporting the key

openssl pkcs12 \
  -in cert.p12 \
  -clcerts \
  -nokeys \
  -info

OpenSSL prompts for the import password. Avoid placing passwords directly on the command line because shell history and process listings can expose them.

Questions the output can answer

• Is the profile expired?
• Does it include this exact UDID?
• Which application identifier does it authorize?
• Is get-task-allow present?
• Which App Groups or keychain groups are listed?
• Does the P12 certificate appear among the profile's authorized certificates?

Inspection cannot tell you whether Apple has since revoked the certificate unless you perform the relevant online trust check. It also cannot prove an unknown IPA is safe.