iOS Enterprise: Re-certify existing IPA with new certificate

StackOverflow https://stackoverflow.com/questions/8402006

Question

We are enrolled in the iOS Enterprise Program. The provisioning profile used for our released apps is about to expire, so I got a new certificate and provisioning profile.

I need to re-distribute some of our apps with the new provisioning profile, without building them anew. How?

(I vaguely remember seeing a utility program that did exactly this: You choose an IPA and a provisioning profile, and it would create a new IPA using the new profile and certificate. What was the tool’s name, and where can I get it?)

Was it helpful?

Solution

In theory whoever built the last IPA in XCode should have used Archive - this creates a build you can sign to create an IPA (using XCode).

You could also try using the command line signing tool XCRun to re-sign the App bundled in your existing IPA:

http://skabber.com/package-your-ios-application-with-xcrun

OTHER TIPS

OK, turns out when you know what term to google, there‘s lots of excellent resources…

They all point to xcrun. I made it work with this shell snippet, adapted from this promising build script:

APP_FILENAME=MyApp.app
BUILD_DIRECTORY=/Path/To/Target/Dir
IPA_FILENAME=MyApp.ipa
DISTRIBUTION_CERTIFICATE='iPhone Distribution'
PROVISIONING_PROFILE_PATH='/Path/To/Profile.mobileprovision'
/usr/bin/xcrun -sdk iphoneos PackageApplication -v "$APP_FILENAME" -o "$BUILD_DIRECTORY/$IPA_FILENAME" --sign "$DISTRIBUTION_CERTIFICATE" --embed "$PROVISIONING_PROFILE_PATH"

The codesign command-line utility, included with the iOS SDK tools, will allow adding/changing the certificate and provision with which a developer built app is signed.

As hotpaw2's anwaswer states. You can also resign using the codesign tool.

The way I do it (this may not be the most efficient, but it works)

  1. Rename the .ipa to a .zip and extract

  2. Run The following:

    /usr/bin/codesign -f -s "iPhone Distribution: Company Name" "Payload/MyApp.app"

  3. Re-zip the Payload folder and rename to .ipa

Note: You can also use this method to edit the embedded.mobileprovisioning file! Just remember to remove the .DS_Store (rm Payload/.DS_Store) if you are using finder.

You can do manual way if you just resigning app from same account with following steps.

All this is using shell script and super easy provided you know how to use shell commands.

  1. Rename IPA to zip
  2. unzip this file to temp folder
  3. Remove the old _CodeSignature folder from all targets (if you have multiple targets like main,watch, watch extn, siri, widget, message, etc)
  4. bring all the targets prov-profiles in one folder and replace all the embedded.provisioningprofile files for each target with the new ones
  5. remove the archived....xccent file as this is old one (optional)
  6. code sign with the entitlements.plist created for all the entitlements if any used by the app.
  7. Zip the folder back after code sign all okay with no errors
  8. Rename the zip to IPA

Note: To validate the IPA before upload to apple you can just use the altool from inbuild XCode App Loader to check the new IPA.

Reference: The steps for commands is also explained here: http://www.enterpriseios.com/forum/topic/Resigning_3rd_party_apps

If you want to get rid of manual sign use the fastlane tool as its quite simple and easy to configure.https://fastlane.tools/

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top