Revoked, expired or just broken?
Tell certificate-wide failure apart from an expired profile, failed refresh, bad IPA or network problem.
“Revoked” is frequently used as a catch-all explanation. It should be a diagnosis, not a reflex.
To check the certificate itself, open the P12 or profile in the certificate checker. It asks Apple's status service whether the certificate is revoked. The P12 is read in the browser and is not uploaded.
Compare symptoms
Likely certificate or profile-wide
- several apps signed with the same identity stop opening around the same time;
- every newly signed app fails verification;
- the certificate or profile status explicitly shows invalid, revoked or expired;
- another known-good IPA fails with the same pair.
Likely one app or package
- other apps signed at the same time still work;
- the failing IPA has unusual extensions or injected tweaks;
- a different IPA installs with the same signing pair;
- the app installs but crashes only after launch.
Likely free-signing expiry
- the seven-day counter reached zero;
- AltStore or SideStore reports that the app needs refresh;
- reprovisioning restores it without changing the source IPA.
Likely installation transport
- signing succeeds but the install never begins;
- Wi-Fi and mobile data behave differently;
- Feather remains at Ready;
- changing the local installation mode changes the result.
Expiry and replacement cover are different
A certificate can have a nominal validity period while a seller offers a shorter replacement window. The end of replacement cover does not itself revoke or expire the certificate. Conversely, a certificate can be invalidated before its displayed expiry.
Treat these as separate dates:
- certificate expiry;
- provisioning-profile expiry;
- free-signing refresh deadline;
- provider replacement deadline.
Before replacing a certificate
Back up app data. A new identity or profile can require re-signing, and changing bundle identifiers or application groups can prevent an in-place update from seeing existing data.
If your provider confirms revocation, follow its private order/replacement route. Never post the P12, password, UDID or order capability in a public channel.