Provisioning profiles flip to invalid for a handful of well-defined reasons. Knowing which one applies tells you whether you need to regenerate the profile, rotate the certificate first, or re-register a device.
Why a profile becomes invalid
- The signing certificate it was issued against was revoked or expired. Fix the certificate first, then regenerate the profile.
- A device that was embedded in the profile was removed from the account. Re-create the profile without that device, or re-add the device.
- A capability on the underlying bundle ID changed. Apple invalidates dependent profiles when capabilities are added or removed; regenerate the profile.
- The profile passed its expiration date. Regenerate to extend.
- An Apple-side state inconsistency cleared up by a fresh sync. Retry the sync first.
Bring it back
- 1
Open the profile
From Profiles, filter by Invalid or Expired and click into the profile. The detail page shows which certificate, devices, and bundle ID it was issued against.
- 2
Diagnose
Check the certificate panel. If it's revoked or expired, that's the root cause. If the certificate is fine, look at the device list for any that have been removed.
- 3
Regenerate
Click Regenerate and pick the certificate and device list you want on the new version. HexSign re-issues through the App Store Connect API and the dashboard updates immediately.