Skip to content
RunnerHub

Code Signing Issues

No Signing Credentials Configured

Section titled “No Signing Credentials Configured”

Error:

xcodebuild: error: No signing certificate found
Code signing error: no credentials configured

Cause: Signing credentials are not set up at the workspace level, or the app signing configuration is missing.

Solution:

  1. Set up API key at workspace level:

    • Go to Workspace Settings > Apple Signing
    • Verify that Issuer ID, Key ID, Team ID, and Private Key are all configured
    • If missing, see API Key Setup

  2. Configure app signing:

    • Go to App Settings > Apple Signing
    • Enter your Bundle Identifier (e.g., com.example.myapp)
    • Select your Signing Type (development, adhoc, or appstore)
    • Click Save

  3. Verify the workspace has valid credentials:

    • Go to Workspace Settings > Apple Signing
    • Click Test Connection (if available) or re-enter your credentials

If you’re on the Free plan, automatic code signing is not available. You must either:

  • Upgrade to PAYG, Pro, or Business, or
  • Manage signing manually in your pipeline using Fastlane Match or another tool

See Code Signing Overview for more information.

Certificate Expired or Revoked

Section titled “Certificate Expired or Revoked”

Error:

xcodebuild: error: Certificate expired
Code signing error: Certificate not valid

Cause: Your Apple Distribution certificate has expired or was revoked in your Apple Developer account.

Solution:

For auto-generated certificates:

  • RunnerHub will automatically create a replacement certificate on the next build
  • No immediate action needed
  • If the error persists, force regeneration by removing and re-adding the API key

For manually uploaded P12 certificates:

  1. Go to Workspace Settings > Apple Signing
  2. Click Remove Certificate
  3. Either:
    • Upload a new valid P12 certificate, or
    • Let RunnerHub auto-generate a new certificate on the next build

To check certificate status in Apple Developer:

  1. Go to App Store Connect
  2. Click Certificates, Identifiers & Profiles > Certificates
  3. Look for your certificate and check its expiration date
  4. If expired and you need to use it, revoke it and create a new one

Bundle ID Not Registered

Section titled “Bundle ID Not Registered”

Error:

Error: Bundle ID not found in Apple account
Provisioning profile creation failed: bundle_identifier_not_registered

Cause: Your bundle ID is not registered in your Apple Developer account.

Solution:

  1. Go to App Store Connect
  2. Click Certificates, Identifiers & Profiles > Identifiers
  3. Click the + icon to create a new identifier
  4. Select App IDs and click Continue
  5. Configure:
    • App Type: Select your app type (iOS App, macOS App, etc.)
    • Description: Any name for reference
    • Bundle ID: Enter your bundle ID (e.g., com.example.myapp)
    • Capabilities: Select any capabilities your app needs
  6. Click Continue and then Register

Back in RunnerHub:

  1. Go to App Settings > Apple Signing
  2. Verify the Bundle Identifier field matches exactly (case-sensitive, including com. prefix)
  3. Click Save

Bundle ID Mismatch

Section titled “Bundle ID Mismatch”

Error:

Signing error: bundle ID mismatch
Expected com.example.myapp, got com.example.wrongapp

Cause: The bundle ID in your app’s RunnerHub settings doesn’t match the bundle ID in your Xcode project.

Solution:

  1. Find bundle ID in your Xcode project:

    • Open your project in Xcode
    • Select the target
    • Go to Build Settings
    • Search for “Bundle Identifier”
    • Copy the value

  2. Update RunnerHub:

    • Go to App Settings > Apple Signing
    • Paste the bundle ID from Xcode into the Bundle Identifier field
    • Ensure it matches exactly (no extra spaces, case-sensitive)
    • Click Save

  3. Verify in Apple Developer:

    • Go to App Store Connect
    • Click Certificates, Identifiers & Profiles > Identifiers
    • Verify your bundle ID is registered

Provisioning Profile Not Found

Section titled “Provisioning Profile Not Found”

Error:

Error: No provisioning profile found
Unable to create profile: bundle ID not registered

Cause: Provisioning profile cannot be created because:

  1. Bundle ID is not registered in Apple account
  2. Your team doesn’t have permission to create profiles
  3. API key doesn’t have sufficient permissions

Solution:

  1. Register bundle ID (see Bundle ID Not Registered above)

  2. Verify API key permissions:

    • Go to App Store Connect
    • Click Users and Access > Keys
    • Find your API key and check its role
    • Role must be Developer or App Manager (not Viewer or Read-only)
    • If permission is insufficient, create a new key with proper access

  3. Re-add API key in RunnerHub:

    • Go to Workspace Settings > Apple Signing
    • Click Remove API Key
    • Re-add the API key with the correct credentials
    • Verify Issuer ID, Key ID, Team ID, and Private Key are correct

  4. Ensure bundle ID is in the correct team:

    • The bundle ID must be registered in the same Apple account/team as your API key
    • If you have multiple teams, verify you’re using the right team for this app

Wrong Signing Type

Section titled “Wrong Signing Type”

Error:

Profile mismatch: expected appstore, found development
Code signing error: Wrong provisioning profile

Cause: The signing type configured in RunnerHub doesn’t match what your build expects or needs.

Solution:

  1. Determine the correct signing type:

    Signing TypeUse Case
    developmentTesting on devices, local development
    adhocAd-hoc distribution to specific devices
    appstoreTestFlight and App Store submission

  2. Update in RunnerHub:

    • Go to App Settings > Apple Signing
    • Click on Signing Type dropdown
    • Select the correct type for your use case
    • Click Save

  3. Re-run the build

P12 Upload Issues

Section titled “P12 Upload Issues”

P12 Password Incorrect

Section titled “P12 Password Incorrect”

Error:

Error: Cannot decrypt P12 file
Password is incorrect or P12 is corrupted

Solution:

  1. Try uploading the P12 again with the correct password
  2. If you forgot the password:
    • Open Keychain Access on your Mac
    • Find your certificate
    • Right-click and select Export
    • Choose Personal Information Exchange (.p12)
    • Set a new password
    • Upload the new P12 to RunnerHub

P12 Not Found in Apple Account

Section titled “P12 Not Found in Apple Account”

Error:

Error: P12 certificate not found in your Apple account
Certificate validation failed

Cause: The P12 certificate you uploaded doesn’t match any certificate in your Apple Developer account.

Solution:

  1. Verify the certificate exists in Apple Developer:

    • Go to App Store Connect
    • Click Certificates, Identifiers & Profiles > Certificates
    • Look for your certificate in the list

  2. If the certificate doesn’t exist:

    • Create a new certificate in Apple Developer
    • Export it from Keychain Access as P12
    • Upload to RunnerHub

  3. If the certificate exists but validation still fails:

    • Try removing the P12 from RunnerHub and re-uploading it
    • Or create a new certificate from scratch

Team ID Mismatch

Section titled “Team ID Mismatch”

Error:

Team ID mismatch: API key is from team ABC123D45E, but certificate is from team XYZ789P01Q

Cause: The API key and certificate (or app configuration) are from different Apple teams.

Solution:

  1. Verify your Team ID:

  2. Update in RunnerHub:

    • Go to Workspace Settings > Apple Signing
    • Ensure the Team ID field matches your actual Apple Team ID
    • Click Save

  3. If using a certificate from a different team:

    • You must use an API key from the same team
    • Revoke the old API key in Apple Developer
    • Create a new API key for the correct team
    • Add it to RunnerHub

Feature Requires Paid Plan

Section titled “Feature Requires Paid Plan”

Error:

403 Forbidden: Code signing feature requires PAYG or higher plan

Cause: You’re on the Free plan. Automatic code signing is only available on PAYG, Pro, and Business plans.

Solution:

Upgrade your plan:

  1. Go to Billing
  2. Click Upgrade Plan
  3. Select your desired plan (PAYG, Pro, or Business)
  4. Complete payment

Alternatively, if you want to stay on Free:

  • Manage code signing yourself within your pipeline
  • Use Fastlane Match or manual certificate management
  • See your pipeline’s documentation for signing setup

ExportArchive Requires Provisioning Profile

Section titled “ExportArchive Requires Provisioning Profile”

Error:

xcodebuild: error: The archive does not have a valid signature and cannot be re-signed
exportarchive: error: requires valid provisioning profile

Cause: The exportArchive command needs a valid provisioning profile to export the archive. This error occurs when:

  1. Auto-sign is not enabled
  2. The provisioning profile was not installed correctly
  3. The ExportOptions.plist is missing or invalid

Solution:

If you have auto-sign enabled, use the auto-generated ExportOptions.plist:

Terminal window
xcodebuild -exportArchive \
  -archivePath $PWD/build/MyApp.xcarchive \
  -exportPath $PWD/build \
  -exportOptionsPlist $RH_EXPORT_OPTIONS_PLIST

If you don’t have auto-sign enabled or prefer a manual plist, create an ExportOptions.plist file in your repository with the correct configuration:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>method</key>
  <string>app-store</string>
  <key>teamID</key>
  <string>ABC123D45E</string>
  <key>signingStyle</key>
  <string>manual</string>
  <key>provisioningProfiles</key>
  <dict>
    <key>com.example.myapp</key>
    <string>00000000-0000-0000-0000-000000000000</string>
  </dict>
</dict>
</plist>

Then reference it in your export command:

Terminal window
xcodebuild -exportArchive \
  -archivePath $PWD/build/MyApp.xcarchive \
  -exportPath $PWD/build \
  -exportOptionsPlist ExportOptions.plist

ExportOptions.plist Not Generated

Section titled “ExportOptions.plist Not Generated”

Error or Issue: The $RH_EXPORT_OPTIONS_PLIST variable is empty or the file doesn’t exist.

Cause: The plist is only generated when:

  1. Auto-sign is enabled for your app
  2. Both the provisioning profile name and bundle identifier are available
  3. No existing ExportOptions.plist exists in the repository root

Solution:

  1. Verify auto-sign is enabled:

    • Go to App Settings > Apple Signing
    • Confirm Bundle Identifier and Signing Type are configured
    • Click Save if you made changes

  2. Check if you have an existing plist:

    • If ExportOptions.plist exists in your repository root, RunnerHub won’t generate one
    • Either remove it (if auto-sign can generate it) or use it explicitly in your commands

  3. Verify the workspace has valid API credentials:

    • Go to Workspace Settings > Apple Signing
    • Ensure API key is configured and valid

  4. Re-run your job — the plist should be generated on the next build

Quick Checklist

Section titled “Quick Checklist”

Before running a signed build, verify:

  • Workspace Settings > Apple Signing has API key configured
  • App Settings > Apple Signing has Bundle ID and Signing Type configured
  • Bundle ID is registered in Apple Developer account
  • API key has Developer or App Manager role
  • Certificate is not expired
  • Team ID matches your Apple account
  • Your plan includes code signing (PAYG or higher)
  • For archive export: Use $RH_EXPORT_OPTIONS_PLIST or provide your own ExportOptions.plist

Getting Help

Section titled “Getting Help”

If the issue persists:

  1. Check your job logs in the RunnerHub dashboard for the exact error
  2. Verify all steps in API Key Setup
  3. Review Per-App Signing Configuration
  4. Confirm your plan supports code signing
  5. Verify your Apple credentials in App Store Connect

See also: Code Signing Overview