Auto-renewal
Distribution certs and provisioning profiles reissue themselves 30 days before expiry. The new cert keeps your existing key; profiles rebuild against the renewed cert in the same run.
Auto-renewal timeline
The secure vault and dashboard for Apple code signing.
HexSign automatically renews your Apple certificates and provisioning profiles before they expire. The rest lives in one place too: an encrypted vault instead of git, a dashboard for every profile and expiration, and a CLI for any CI. No more expired-cert fire drills.
iOS · macOS · tvOS · watchOS
hexsign · dashboard
Health
100%
Certificates
Apple Distribution
expires 7/4/2027Apple Push Services
expires 2/14/2027Mac Installer Dist
expires 10/27/20263 profiles linked to expiring certView certificate relationship graph
Ships signing assets to any CI. Bring your own pipeline.
See it in action
HexSign in 60 seconds
A walkthrough of the dashboard, certificate relationships, and the provisioning profile wizard. Open the watch page →
One source of truth for Apple code signing.
An encrypted vault for certificates, a dashboard for every profile and expiration, and a CLI that ships signing assets to any CI. Synced with App Store Connect.
Relationship graph
See how certificates, profiles, and bundle IDs connect. Understand the blast radius before revoking.
Expiration alerts
Email, Slack, Teams, Jira, PagerDuty, and incident.io, with configurable thresholds and test runs. Fire only when auto-renewal can't act.
Alert routing rules
Profile wizard
A guided flow that picks the right identifier, certificate, and devices and generates the profile through Apple's API.
Profile creation wizard
Apple's Developer Portal wasn't built for teams. Neither was your git repo.
Certificates live in git or shared drives. Profiles break in CI. Nobody knows which app is affected until a release fails at 5pm on a Friday. If any of the following sound familiar, HexSign is for you.
Certificates and .p12 files live in git, Dropbox, or a shared 1Password vault
fastlane match works, but committing encrypted secrets still feels wrong
CI pipelines fetch signing material from a dozen ad-hoc places
Certificates and profiles expire mid-release and someone has to rotate them by hand
No visibility into profile-certificate dependencies
developer.apple.com makes it hard to find issues across multiple Apple accounts
How it works
From Apple account to vault, dashboard, and CI.
01
Connect your Apple Developer account
Add your App Store Connect API key (Issuer ID, Key ID, and private key). HexSign authenticates securely using Apple's official API.
02
Auto-sync certificates & profiles
HexSign pulls all your certificates, provisioning profiles, bundle IDs, and devices. Changes are detected on each sync.
03
Explore the relationship graph
See how everything connects in an interactive visual graph. Color-coded by status so problems jump out instantly.
04
Set up alerts and stay ahead
Configure alerts to email, Slack, Microsoft Teams, or your incident tooling with custom thresholds. Get notified days before anything expires.
Enterprise-ready from day one
Multi-account management, audit logs, sync history, RBAC, and encrypted API key storage. Built for teams that take security seriously.
Bring your own CI. Fetch signing assets from the vault.
The HexSign CLI pulls certificates and profiles straight from the encrypted vault into any pipeline: GitHub Actions, GitLab, Bitrise, Codemagic, fastlane, or your own shell. No certs in git, no fastlane match repo, no shared Apple ID. Explore the CLI →
Is HexSign right for you?
HexSign is a great fit if you:
Store Apple certificates in git, fastlane match, or shared drives and want a managed vault instead
Run CI/CD that depends on code signing and want a CLI that works across GitHub Actions, GitLab, Bitrise, or any shell
Manage iOS or macOS apps in production
Work across multiple Apple Developer accounts
Need to track certificate expirations before they break a release
Want to understand cert-profile-app relationships at a glance
See how we compare
HexSign vs the alternatives
Open-source CLI
HexSign vs Fastlane Match
Read HexSign vs Fastlane MatchApple's first-party portal
HexSign vs Apple Developer Portal
Read HexSign vs Apple Developer PortalCI/CD with managed signing
HexSign vs Codemagic
Read HexSign vs CodemagicMobile DevOps platform
HexSign vs Bitrise
Read HexSign vs BitriseApple's managed CI/CD with automatic signing
HexSign vs Xcode Cloud
Read HexSign vs Xcode CloudLearn the fundamentals
Key Apple code signing concepts
Code signing
The process of attaching a cryptographic signature to a binary so the operating system can verify who built it and that nothing has changed since. Required for every app shipped on Apple platforms.
Read definition
Provisioning profile
A signed plist Apple issues that links a specific App ID, signing certificate, list of devices (for development and Ad Hoc), and entitlements. Without a matching profile, iOS will refuse to launch your build.
Read definition
App Store Connect
Apple's web console for managing App Store and TestFlight submissions, App Store Connect API keys, in-app purchases, builds, testers, and team access. Distinct from the Apple Developer portal.
Read definition
Apple Developer Program
Apple's paid membership program ($99/year) that lets a company or individual sign apps, distribute through the App Store and TestFlight, and access betas of Apple's developer tools.
Read definition
Code signing certificate
Umbrella term for any Apple-issued certificate used to sign a binary, installer, or push token. Covers Apple Development, Apple Distribution, Developer ID, APNs, Pass Type ID, and Mac Installer certificates.
Read definition
fastlane match
A fastlane action that stores Apple signing material (certificates, private keys, provisioning profiles) in a shared, encrypted git repo so every developer and CI runner can pull the same identities.
Read definition