Signing

Manage signing certificates and provisioning profiles

Fetch and manage code signing assets for your applications.

Overview

The signing command provides high-level operations for managing code signing workflows, automatically resolving and downloading the certificates and provisioning profiles needed for app distribution.

Fetch Signing Files

Fetch certificates and provisioning profiles for an app in a single command:

asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_STORE \
  --output ./signing

This command:

Resolves the bundle ID in App Store Connect
Finds matching certificates for the profile type
Finds or creates a provisioning profile
Downloads certificates (.cer) and profile (.mobileprovision)
Saves files to the output directory

Required Flags

--bundle-id - Bundle identifier (e.g., com.example.app)
--profile-type - Type of provisioning profile (see Profile Types)

Optional Flags

--output - Output directory (default: ./signing)
--app - App Store Connect app ID (validates bundle ID match)
--certificate-type - Filter specific certificate type (usually auto-inferred)
--device - Device IDs for development profiles (comma-separated)
--create-missing - Create a new profile if none exists
--format - Output format for metadata: json, table, markdown (default: json)

Profile Types

iOS Profile Types

App Store Distribution:

asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_STORE

Used for: App Store submission
Certificate type: IOS_DISTRIBUTION
Devices: Not required

Development:

asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_DEVELOPMENT \
  --device "DEVICE_ID_1,DEVICE_ID_2"

Used for: Local development and testing
Certificate type: IOS_DEVELOPMENT
Devices: Required (use asc devices list to find IDs)

Ad Hoc:

asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_ADHOC \
  --device "DEVICE_ID_1,DEVICE_ID_2"

Used for: External testing (outside TestFlight)
Certificate type: IOS_DISTRIBUTION
Devices: Required

In-House (Enterprise):

asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_INHOUSE

Used for: Enterprise internal distribution
Certificate type: IOS_DISTRIBUTION
Devices: Not required
Requires: Apple Developer Enterprise Program

tvOS Profile Types

TVOS_APP_STORE - App Store distribution
TVOS_APP_DEVELOPMENT - Development
TVOS_APP_ADHOC - Ad Hoc distribution
TVOS_APP_INHOUSE - Enterprise distribution

macOS Profile Types

App Store:

asc signing fetch --bundle-id com.example.macapp \
  --profile-type MAC_APP_STORE

Certificate type: MAC_APP_DISTRIBUTION

Direct Distribution:

asc signing fetch --bundle-id com.example.macapp \
  --profile-type MAC_APP_DIRECT

Certificate type: DEVELOPER_ID_APPLICATION
Used for: Distribution outside Mac App Store

Development:

asc signing fetch --bundle-id com.example.macapp \
  --profile-type MAC_APP_DEVELOPMENT

Certificate type: MAC_APP_DEVELOPMENT

Mac Catalyst:

MAC_CATALYST_APP_STORE - Mac App Store
MAC_CATALYST_APP_DIRECT - Direct distribution
MAC_CATALYST_APP_DEVELOPMENT - Development

Certificate Type Inference

The CLI automatically infers the correct certificate type from the profile type:

Profile Type	Certificate Type
IOS_APP_STORE	IOS_DISTRIBUTION
IOS_APP_DEVELOPMENT	IOS_DEVELOPMENT
IOS_APP_ADHOC	IOS_DISTRIBUTION
IOS_APP_INHOUSE	IOS_DISTRIBUTION
TVOS_APP_STORE	TVOS_DISTRIBUTION
TVOS_APP_DEVELOPMENT	TVOS_DEVELOPMENT
MAC_APP_STORE	MAC_APP_DISTRIBUTION
MAC_APP_DEVELOPMENT	MAC_APP_DEVELOPMENT
MAC_APP_DIRECT	DEVELOPER_ID_APPLICATION

Override with --certificate-type if needed.

Create Missing Profiles

Create a new provisioning profile if none exists:

asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_STORE \
  --create-missing

For development profiles, devices are required:

asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_DEVELOPMENT \
  --device "DEVICE_ID_1,DEVICE_ID_2" \
  --create-missing

If --create-missing is not specified and no matching profile exists, the command will fail with an error suggesting you use this flag.

Output Files

Files are saved to the output directory with sanitized names: Provisioning Profile:

./signing/IOS_APP_STORE-20250304.mobileprovision

Certificates:

./signing/A1B2C3D4E5.cer
./signing/F6G7H8I9J0.cer

File names are based on profile name/ID and certificate serial numbers.

Complete Example Workflows

App Store Submission

# 1. Fetch App Store signing files
asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_STORE \
  --output ./signing

# 2. Install certificate in keychain
security import ./signing/*.cer -k ~/Library/Keychains/login.keychain-db

# 3. Install provisioning profile
cp ./signing/*.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/

# 4. Build and sign your app
xcodebuild -project MyApp.xcodeproj \
  -scheme MyApp \
  -configuration Release \
  -archivePath ./build/MyApp.xcarchive \
  archive

Development Setup

# 1. List your registered devices
asc devices list --platform IOS --output table

# 2. Fetch development signing files
asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_DEVELOPMENT \
  --device "DEV_DEVICE_1,DEV_DEVICE_2,DEV_DEVICE_3" \
  --output ./signing \
  --create-missing

# 3. Install files
security import ./signing/*.cer -k ~/Library/Keychains/login.keychain-db
cp ./signing/*.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/

CI/CD Integration

# GitHub Actions example
- name: Fetch signing files
  run: |
    asc signing fetch \
      --bundle-id com.example.app \
      --profile-type IOS_APP_STORE \
      --output ./signing

- name: Import certificate
  run: |
    security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
    security default-keychain -s build.keychain
    security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
    security import ./signing/*.cer \
      -k build.keychain \
      -P "" \
      -T /usr/bin/codesign
    security set-key-partition-list -S apple-tool:,apple: \
      -s -k "$KEYCHAIN_PASSWORD" build.keychain

- name: Install provisioning profile
  run: |
    mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
    cp ./signing/*.mobileprovision \
      ~/Library/MobileDevice/Provisioning\ Profiles/

Troubleshooting

Bundle ID Not Found

Error: bundle ID not found: com.example.app

Solution: Create the bundle ID first:

asc bundle-ids create --identifier com.example.app \
  --name "My App" \
  --platform IOS

No Certificates Found

Error: no certificates found for type IOS_DISTRIBUTION

Solution: Create a certificate:

# 1. Generate CSR
asc certificates csr generate --key-out ./cert.key --csr-out ./cert.csr

# 2. Create certificate
asc certificates create --certificate-type IOS_DISTRIBUTION \
  --csr ./cert.csr

No Active Profile Found

Error: no active profile found for bundle ID; use --create-missing to create one

Solution: Add --create-missing flag or create profile manually:

asc profiles create --name "My App Store Profile" \
  --profile-type IOS_APP_STORE \
  --bundle "BUNDLE_ID" \
  --certificate "CERT_ID"

Devices Required for Development

Error: --device is required for development profiles

Solution: Specify device IDs:

# List devices to find IDs
asc devices list --platform IOS --output table

# Add devices to command
asc signing fetch --bundle-id com.example.app \
  --profile-type IOS_APP_DEVELOPMENT \
  --device "DEVICE_ID_1,DEVICE_ID_2"

Certificates - Manage individual certificates
Profiles - Manage provisioning profiles
Bundle IDs - Manage bundle identifiers

Overview

App Management

TestFlight & Builds

Monetization & Analytics

Signing

Review & Release

Team & Access

Automation & Utilities

Signing

Signing

Overview

Fetch Signing Files

Required Flags

Optional Flags

Profile Types

iOS Profile Types

tvOS Profile Types

macOS Profile Types

Certificate Type Inference

Create Missing Profiles

Output Files

Complete Example Workflows

App Store Submission

Development Setup

CI/CD Integration

Troubleshooting

Bundle ID Not Found

No Certificates Found

No Active Profile Found

Devices Required for Development

​Signing

​Overview

​Fetch Signing Files

​Required Flags

​Optional Flags

​Profile Types

​iOS Profile Types

​tvOS Profile Types

​macOS Profile Types

​Certificate Type Inference

​Create Missing Profiles

​Output Files

​Complete Example Workflows

​App Store Submission

​Development Setup

​CI/CD Integration

​Troubleshooting

​Bundle ID Not Found

​No Certificates Found

​No Active Profile Found

​Devices Required for Development

​Related Commands

Signing

Overview

Fetch Signing Files

Required Flags

Optional Flags

Profile Types

iOS Profile Types

tvOS Profile Types

macOS Profile Types

Certificate Type Inference

Create Missing Profiles

Output Files

Complete Example Workflows

App Store Submission

Development Setup

CI/CD Integration

Troubleshooting

Bundle ID Not Found

No Certificates Found

No Active Profile Found

Devices Required for Development

Related Commands