Protect your certificate and Apple Account
Handle P12 files, provisioning profiles, passwords, UDIDs and signing tools safely.
Signing material deserves the same care as an account credential.
P12 and password
The P12 contains a private signing key. Keep the file and password out of public Discord channels, shared cloud folders and unknown web tools. Store an encrypted backup so losing one phone does not also destroy your only copy.
If a service supplies the files, learn whether you can download them again and how long it retains them. A “certificate checker” should not require the private key merely to inspect public profile metadata.
Provisioning profile and UDID
A provisioning profile is not a private key, but it contains identifiers and capability information. A UDID is a stable device identifier. Neither belongs in public screenshots or searchable chat logs.
Apple requires a device ID to register a device for development or ad hoc provisioning. See Apple's device registration documentation.
Apple Account credentials
Free-signing tools may need to authenticate to Apple's developer services. Prefer open-source, established tools and their official downloads. Understand whether authentication occurs locally, whether an app-specific password is supported and whether any intermediary service receives account information.
Use a separate Apple Account when a tool's model justifies it, and enable strong account security. Never type the password into a random web signer or send a two-factor code to a support person.
Configuration profiles
Before installing a .mobileconfig, read the permissions iOS displays. A simple device-identification profile and a device-management enrollment profile are not equivalent. Apple lets you inspect installed profiles under Settings → General → VPN & Device Management. See Apple's profile guide.
Remove a profile you no longer recognise or need, but first understand whether removing it will also remove managed applications or data.