Skip to content
PandaSuite Docs

Replace an expiring or expired iOS distribution certificate

Apple distribution certificates cannot be extended. Whether your iOS distribution certificate is about to expire or already expired, create a new certificate, update the provisioning profile that uses it, and export a new IPA in PandaSuite.

Apple documents this workflow in its Certificates overview and provisioning profile management.

What changes when your certificate expires

A distribution certificate is used to sign the IPA you export. When Apple warns that it is expiring, or if the certificate is already expired, you do not edit the existing certificate. You create a new one and replace the signing assets used for your next export.

In practice, you usually need to update three items:

  • a new .p12 distribution certificate
  • a provisioning profile regenerated with this new certificate
  • a new IPA exported from PandaSuite with the updated files

Step 1: Create a new distribution certificate

For App Store or ad hoc distribution, generate a new iOS Distribution (App Store and Ad Hoc) certificate with EasyCertif or by following Generate an iOS certificate.

If you use the Apple Developer Enterprise Program, follow the certificate type described in Distribute your iOS app in-house.

Save the new .p12 file and its password. You will need both during the next IPA export.

Step 2: Regenerate the provisioning profile

Open Apple Developer and create or edit the provisioning profile linked to your app. During the certificate selection step, choose the new distribution certificate, then download the updated .mobileprovision file.

Follow Create an iOS provisioning profile for the complete procedure.

If you publish the same app in several modes, repeat this step for each provisioning profile concerned.

Step 3: Export a new IPA in PandaSuite

In PandaSuite, go to Apps, open the Mobile (iOS / Android) tab, and click Export IPA. Import:

  • the new .p12 file
  • its password
  • the updated .mobileprovision file

Use Export an IPA file for the full export flow.

Impact on your app

  • App Store: your current app remains available to existing users. You simply use the new certificate and provisioning profile for your next submission or update.
  • Ad Hoc: plan to export and redistribute a new IPA signed with the refreshed assets. This keeps your private distribution aligned with the active provisioning profile and certificate.
  • In-House: export and redistribute a new IPA before the current signing assets expire. Apple notes that users can no longer run in-house apps signed with an expired distribution certificate.

What does not change

  • Your Team ID does not change.
  • Your Bundle ID does not change.
  • This renewal does not replace your APNs certificate or key for push notifications. Push signing has its own credentials and lifecycle. Learn more in Push notifications to iOS and Android devices.

Verify the new signing assets

  • Your provisioning profile shows the new certificate in Apple Developer.
  • The IPA export completes successfully in PandaSuite.
  • Your new build installs correctly, or your next App Store submission uses the refreshed files without signing errors.

See also