Provisioning profiles flip to invalid for a handful of well-defined reasons. Knowing which one applies tells you whether you need to regenerate the profile, rotate the certificate first, or re-register a device.
Why a profile becomes invalid
- The signing certificate it was issued against was revoked or expired — fix the certificate first, then regenerate the profile.
- A device that was embedded in the profile was removed from the account — re-create the profile without that device, or re-add the device.
- A capability on the underlying bundle ID changed — Apple invalidates dependent profiles when capabilities are added or removed. Regenerate the profile.
- The profile passed its expiration date — regenerate to extend.
- An Apple-side state inconsistency cleared up by a fresh sync — retry the sync first.
Bring it back
- 1
Open the profile
From Profiles, filter by Invalid or Expired and click into the profile. The detail page shows which certificate, devices, and bundle ID it was issued against.
- 2
Diagnose
Check the certificate panel — if it's revoked or expired, that's the root cause. If the certificate is fine, look at the device list for any that have been removed.
- 3
Regenerate
Click Regenerate and pick the certificate and device list you want on the new version. HexSign re-issues through the App Store Connect API and the dashboard updates immediately.