The Gatekeepers
You cannot build an iOS app and simply distribute it. Apple requires every binary to be cryptographically signed before it can run on any device — including your own. This signing process proves to Apple (and to the device) that the binary came from a known developer and has not been tampered with. The same principle applies to Windows, where Microsoft's Authenticode signing prevents SmartScreen from flagging your installer as untrusted.
Apple's Signing Triangle
iOS code signing requires three distinct artifacts that must all match each other:
1. Certificate (.p12 file)
This is your cryptographic identity. It answers "Who built this?" It is issued by Apple and tied to your Apple Developer account. Certificates expire (typically after one year) and must be renewed. The private key for this certificate must be present in the macOS Keychain on the machine doing the build. If the key is missing, the build fails — even if the certificate file is present.
2. App ID (Bundle Identifier)
A reverse-domain string like com.mycompany.myapp that uniquely identifies your application in Apple's systems. This must be registered in the Apple Developer Portal and must match the bundle identifier in your Xcode project exactly.
3. Provisioning Profile
This is the glue. A provisioning profile is a file issued by Apple that binds together: a specific Certificate, a specific App ID, and a list of allowed devices (for development profiles) or a distribution method (for App Store profiles). It answers "This certificate is allowed to sign this app for these purposes." Profiles also expire and must be regenerated when certificates are renewed or new devices are added.
If any of these three artifacts is missing, expired, or mismatched, Xcode produces an error like No profile for team 'XYZ' matching 'com.my.app' found and the build stops immediately.
Windows Authenticode Signing
Windows uses a similar model. You purchase a Code Signing Certificate from a trusted Certificate Authority (CA) such as DigiCert or Sectigo. You then use tools like signtool.exe to embed a signature in your .exe or .msi installer. Without this signature, Windows SmartScreen displays a warning: "Windows protected your PC — this app is from an unknown publisher." Users frequently abandon installations at this warning, making signing a business requirement, not just a security one.
The Team Management Problem
The real challenge is not signing a single build — it is managing these artifacts across a team of 20 developers and a CI server, over multiple years, as certificates expire and team members join and leave. The naive approach (emailing .p12 files to each developer, storing profiles in a shared folder) leads to:
- Certificates installed on one developer's machine but not another's
- Expired profiles that nobody knows how to renew
- CI servers that break when a certificate expires at 2 AM
- Security exposure when a developer leaves and still has the private key
This is the problem that fastlane match was built to solve.