Provisioning profile doesn't include the application-identifier and keychain-access-groups entitlements

Question

This post relates to a rapidly changing event.

I've tried all the other questions and searched everything on this that I could already, a lot of the other questions involved existing apps that were being updated or people with developer accounts but this is like my second time using Xcode and it has worked before.

This just happened out of nowhere. I keep getting these two errors and it allows me to run simulators but not build onto my iPhone:

1. Automatic signing is unable to resolve an issue with the "LearningSpriteKit" target's entitlements. Automatic signing can't add the application-identifier and keychain-access-groups entitlements to your provisioning profile. Switch to manual signing and resolve the issue by downloading a matching provisioning profile from the developer website. Alternatively, to continue using automatic signing, remove these entitlements from your entitlements file and their associated functionality from your code.

2. Provisioning profile "iOS Team Provisioning Profile: #####.LearningSpriteKit" doesn't include the application-identifier and keychain-access-groups entitlements.

Answer 1

This issue is related to Bug 1534145. SSL.com: P-384 curve / ecdsa-with-SHA256 certificates.

A representative from Apple estimated 558,000 certificates to become invalidated: Bug 1533655. DigiCert: Apple: Non-compliant Serial Numbers

GoDaddy, Google, Apple and Facebook (that would explain why Facebook was glitchy today) are affected.

They are working on resolving the issue right now.

That would explain our problems, folks!

Update: The issue has been resolved. Try to refresh your projects.

Answer 2

Workaround: change Bundle Identifier and/or Version.

Answer 3

I restored a profile from Time Machine when this was working and upon launch, Xcode immediately deletes and replaces it with a new one. The key difference seems to be the old profile has the get-task-allow entitlement while the new one has NO entitlements. This is definitely broken at Apple's end.

Edit: The entitlements should also include a keychain access group, but again, no entitlements at all. Should look like:

Answer 4

EDIT

As per latest update Apple successfully resolved Automatically Code Sign with Free Account issue.

I tried it and I can confirm its resolved.

Please try at your end.

Update

Tested with Latest XCode 10.2 and it's working fine + they improved performance of overall Xcode & codesign feature.

I am also facing the same issue while I am creating a new Profile from Xcode and if I go to other projects and check over there also I am facing the same issue as below.

Due to this issue, none of my projects can build with the old profile and certificate.

The strange issue, so I checked a newly created Profile and compared with the old one, and I found that App ID is unknown as well as there were no Entitlement details in the newly created profile.

Check the below screenshots of the old and new profile comparison:

Old Profile:

New Profile:

So it means it's not able to set App Id and Entitlements in the new profile. So the end result does not work all old profiles and giving the same error in all projects.

Issue Workaround:

Step1: Go to Provisioning Profile folder (path: ~⁨Library⁩ ▸ ⁨MobileDevice⁩ ▸ ⁨Provisioning Profiles⁩).

Or use a shortcut to jump directly into this folder like CMD + Shift + G and enter ~/Library/MobileDevice/Provisioning Profiles it will redirect your finder directly on the Provisioning Profiles folder.

Step2: Sort the files inside that folder by Date Modified.

Step3: Check profile with Unknown App Id and delete all unknown profiles.

Step4: Come back on Xcode and check all old projects will work as expected.

Note: Make sure none of your project open while doing above changes. Otherwise, it will create a new profile with Unknown App Id.

I hope this will help and Apple will solve this bug soon!

Answer 5

It seems Apple broke the automatic signing system. I was playing around with a few projects and Xcode just fetches the incorrect profile.

This worked for me:

1. Turn off "Automatically manage signing" in project target
2. Go to ~/Library⁩/⁨MobileDevice⁩/⁨Provisioning Profiles⁩
3. Remove previously downloaded profiles
4. Turn on "Automatically manage signing" again

Answer 6

UPDATE: This solution still works as on 2019/Mar/20 7:00 UTC+0

SOLUTION: no Xcode reinstallation is required. I used a brand new free AppleId, but later checked with my old AppleID and it also works.

1. In Xcode, under the General tab, untick the Automatically manage signing option
2. Close Xcode.

3. Erase old profiles in ~/Library/MobileDevice/Provisioning Profiles:

   cd ~/Library/MobileDevice/Provisioning\ Profiles
   
   rm -rf *
   

4. On MacOS, run Launchpad → Other → Keychain Access and remove all certificates related to iPhone development, like the following four on the picture:

   • Apple Worldwide Developer Relations Certification Authority
   • Developer ID Certification Authority

   • iPhone Developer: your_name_or_email

     

5. Uninstall the old app on iPhone. Restart both iPhone and Mac

6. Open Xcode and change the Bundle Identifier of your app, at least one character (later you may revert this change)
7. Enable the Automatically manage signing option in Xcode.

After this you should be able to run and debug your app on your device.

If you have a “iPhone has denied the launch request” problem, the solution is in an answer to Stack Overflow question iOS 12 iPad Denied Launch Request - Xcode.

In short, you need in Xcode to go to menu Product → Scheme → Edit Scheme... and select Executable: ask on launch.

Answer 7

This issue has been resolved, BUT some people still have a problem with it. If you're one of them, try the following:

1. In the General tab of target settings - uncheck the Automatically manage signing option

2. Close Xcode (fully, not just your project)

3. Erase .mobileprovision files under ~/Library/MobileDevice/Provisioning Profiles/

4. In Keychain Access, delete the following:

• iPhone Developer: [email protected]
• Developer ID Certification Authority
• Apple Worldwide Developer Relations Certification Authority 3.

5. Delete the app on your iOS devices

6. Restart your Mac and iOS devices

7. Open Xcode again

8. Change the Bundle Identifier (even if it's a single character, you'd change it back to the original after you get it going)

9. Check the Automatically manage signing option

10. Use USB to connect your iPhone/iPad.

11. Make sure you trust your certificate on your iOS devices

This should do work for you.

Answer 8

It seems that this problem has been resolved now and the personal accounts can resign their apps automatically again.

Regarding to @Paul answer, it is not related to uninstalling Xcode. It is fixed from the server side.

The only thing that is required is removing Apple Developer Certificate (for the personal account) from your keychain, so that Xcode retries to generate and download a new one.

Answer 9

Here is the solution:

1. Let Xcode be open.

2. Select your developer account and let the error appear again.

3. Go to the keychain app

4.a) Goto certificate section

4.b) Remove All (valid and invalids) certificates (I have three valid and many invalid!)

5. After removing the last certificate, macOS will recreate a new certificate for the active developer account automatically.

6. Run your app in your iDevice. You need to enter your system password to add newly created certificate into the Keychain.

If in the second run it says

Your iPhone has denied the launch request

Just go to:

Product → Scheme → *edit scheme: uncheck "Debug executable"

I hope it solves your problem.

Answer 10

I got it to work by doing the following steps:

1. Go to Xcode
2. Preferences
3. Accounts
4. Manage certificates
5. Plus sign
6. iOS Development
7. Done
8. Download manual Profiles
9. Close
10. Go to your target
11. Change development team to none
12. Change development team to your previous team

It should work.

Answer 11

I am finally able to deploy to our iOS devices again. Here are the steps I took to make it work.

First, I followed all 10 steps in Zameer's answer here. I have copied them below:

1. Open your project in XCode.
2. Select your project from the project navigator and then select your target from the column.
3. Click on the General tab and under the Signing section, make sure "Automatically manage signing" is enabled.
4. Click on the Capabilities tab and turn On both the "App Groups" and "Keychain Sharing" settings. This might raise an "Automatic signing failed" popup error, just click cancel to make it go away.
5. This should generate a entitlements file for you named nameProject.entitlements in the project folder of your project navigator.
6. Move this entitlements file outside of the folder, just below your project file.
7. Select your target again and return to the Capabilities tab to turn Off both the "App Groups" and "Keychain Sharing" settings. This again might raise an "Automatic signing failed" popup error, just click cancel to make it go away.
8. Now select your project above the target and go to Building Settings tab.
9. Scroll down to the Code Signing Identity setting under the Signing header and select iOS Developer from each drop down.
10. Under the above Signing header, double click the text field beside the Code Signing Entitlements and enter the name of your entitlements file, nameProject.entitlements.

After completing those 10 steps, the 2 red entitlement error messages in XCode went away and I was able to build and deploy the XCode test app to the iPhone and run it.

Although that XCode test app could build and deploy, I develop on a PC using Xamarin and I was unable to deploy my Xamarin.iOS application to my iOS devices and kept getting an error in Visual Studio: the executable was signed with invalid entitlements. I did the following things and now I can deploy my Xamarin app and run it on my iOS devices:

1. I deleted the provisioning profile from the Mac in the ~/Library/MobileDevice/Provisioning Profiles directory. XCode immediately generated a new provisioining profile (I'm not sure if this step was necessary but I'm just writing it because that's what I did).
2. I changed my Xamarin.iOS.csproj file and removed Entitlements.plist from the CodesignEntitlements element so it now just looks like <CodesignEntitlements></CodesignEntitlements>. Visual Studio automatically added two elements to the same propertygroup in the project which are probably not necessary but I thought I'd mention: <CodesignExtraArgs /> and <CodesignResourceRules />.

Answer 12

Maybe forum post [iOS 12 SDK] - deadline March 2019 - Legacy Mode might help.

It talks about Apple refusing to build iOS applications under SDK 12 as of March 2019 (OP from Dec 2018).

I've not yet tried this, but it may be linked to the issue. I have a free developer account and am also experiencing this bug.

Here's a screenshot in case the link changes (screenshot 1 below).

This is the link from the first screenshot (screenshot 2 below)

1

2

Answer 13

There is one other potential source of this error. If you do not have a valid signed development certificate setup within your Xcode environment it will throw similar errors as posted by the OP.

You can check out your development certificates status following the Apple link here.

Answer 14

For macOS Big Sur Beta

1. Archive in Xcode 11
2. Upload with Xcode 12 beta organizer (Window -> Organizer)

Answer 15

For me, it finally works again. Either they just fixed it or any of my other steps helped:

1. Uninstall Xcode and all related files (using AppCleaner)
2. Install Xcode via the App Store
3. Change the Bundle Identifier of the App
4. Remove all "iOS Developer" Keys from Keychain

Answer 16

Here is a temporary workaround:

1. Change Bundle Identifier: Target → General → Identity → Bundle Identifier (set this to a different value than it is right now)
2. Change Version: Target → General → Identity → Version
3. Disable debug executable: Product → Scheme → Edit Scheme (uncheck the box that says "debug executable")
4. Delete Provisioning Profiles: ~/Library/MobileDevice/Provisioning Profiles delete everything in this folder.

You now should be able to build and run projects on simulators and devices.