Troubleshooting
Diagnose before deleting anything
A fast decision tree for separating IPA, signer, certificate, profile and installation failures.
Start by preserving evidence and local app data. Do not delete the existing app, signer or certificate until you know which layer failed.
1. Where did it fail?
- Import: P12/profile/password or corrupt file.
- Signing: IPA structure, nested components, entitlements, certificate/profile mismatch or signer bug.
- Install prompt never appears: signer's local server, manifest, HTTPS, VPN/DNS or network path.
- Installation begins then fails: signature, profile, UDID, bundle identifier, storage or package integrity.
- Installs but will not open: trust, Developer Mode, certificate/profile expiry, PPQ verification or runtime incompatibility.
- Opens then crashes: app compatibility, missing frameworks, injected tweak, entitlement/runtime assumptions or corrupted app data.
2. Determine the blast radius
Test without deleting the important app:
| Observation | More likely area |
|---|---|
| One IPA fails, others sign and install | IPA or its extensions/entitlements |
| Every new app fails, old signed apps open | profile/certificate state, signer or installation path |
| All signed apps stopped opening together | certificate/profile expiry, revocation or trust |
| Wi-Fi fails but mobile data works | local install server, DNS, VPN or router path |
| New build installs as a second app | changed bundle identifier |
| Signing succeeds but no install prompt | installation transport, not cryptographic signing |
3. Capture useful facts
- exact error text or error code;
- iOS/iPadOS version and device model;
- signer and version;
- IPA version and source;
- Development or Distribution profile;
- profile expiry date;
- bundle identifier used;
- whether the UDID is included;
- whether other newly signed apps work;
- network type and VPN/custom DNS state.
4. Change one variable
Try a small, known-good IPA with the same signing pair. Then try the failing IPA with no optional tweaks or extensions. Change the network only when the failure is in the installation transport. Change the certificate/profile only when evidence points to signing eligibility.
Randomly switching DNS, identifiers, certificates and signer settings at once can produce a working app without revealing which change mattered. That leaves you unable to repeat it.
Paid CertificatesFrom cert.fish: no computer, no weekly refresh. One purchase for one iPhone.Buy - £6.75