ITMS-90035: Invalid Signature

The full message reads: "The binary … contains an invalid signature. Make sure you have signed your application with a distribution certificate, not an ad hoc certificate or a development certificate." Apple's advice that follows it is aimed at local Xcode builds and rarely helps if you build in the cloud.

What actually causes it

Three possibilities, in order of likelihood:

1. Wrong certificate type. A development certificate was used. Development certificates install on registered test devices; they cannot be uploaded.
2. Wrong profile type. An Ad Hoc or Development profile was used instead of an App Store profile.
3. Certificate/profile mismatch. The profile embeds a different certificate than the one that signed the build.

Verify what you actually have

Before rebuilding, confirm your provisioning profile really is a distribution profile. Decode it and check two fields:

• get-task-allow must be false. If it's true, that's a development profile — debugging is permitted, which App Store builds forbid.
• ProvisionedDevices must be absent. If a device list exists, it's a development or ad-hoc profile.

A genuine App Store profile has get-task-allow = false and no device list.

The trap that catches cloud builds: certificate naming

This one is worth knowing because it produces ITMS-90035 even when you believe you used a distribution certificate.

Apple issues two styles of distribution certificate:

• iPhone Distribution: Your Name — the older naming
• Apple Distribution: Your Name — the newer, unified naming

Both are valid distribution certificates to Apple. But some build services classify certificates by name, and tooling written against the older convention can flag an Apple Distribution certificate as non-distribution — then sign the build with development settings. The upload then fails with ITMS-90035 despite everything looking correct in your account.

We hit exactly this on Unity Build Automation: the credential reported isDistribution: false for an Apple Distribution certificate, while an iPhone Distribution certificate on the same account reported true and shipped fine.

Fix: if your cloud build service rejects or mis-classifies your certificate, generate an iOS Distribution (App Store and Ad Hoc) certificate rather than an Apple Distribution one, and create a fresh provisioning profile bound to it.

Step-by-step fix

1. Create or locate an iOS Distribution certificate — and make sure you hold its private key (export both as a .p12).
2. Create an App Store provisioning profile for your bundle ID, bound to that certificate.
3. Confirm the profile is ACTIVE — changing App ID capabilities silently invalidates profiles.
4. Rebuild with manual signing, assigning the profile to the Unity-iPhone target only.
5. Upload again.

Frequently asked questions