App ID, provisioning profile, and signing certificate

WHAT THIS TESTS This foundational question reveals whether you understand why iOS installs sometimes fail and how Apple establishes that a binary is authentic and authorized for a device.

A GOOD ANSWER COVERS The signing certificate, paired with a private key in your keychain, is your identity: signing the app with it proves the build came from an authorized developer or team. The App ID identifies the application, usually via an explicit bundle identifier, and declares which capabilities or entitlements it may use, such as push notifications or app groups. The provisioning profile is the document, issued and signed by Apple, that binds these together: it references the App ID, lists which signing certificates are valid, encodes the entitlements, and for development and ad hoc distribution enumerates the specific device UDIDs allowed to run the build. At install and launch, iOS checks that the app's signature matches an allowed certificate in the embedded profile, that the bundle ID matches the App ID, that entitlements are authorized, and that the device is permitted, otherwise it refuses to run.

COMMON WRONG ANSWERS Conflating the certificate with the provisioning profile. Thinking the App ID is just a string with no entitlement role. Forgetting that development and ad hoc profiles are device-restricted while App Store profiles are not.

LIKELY FOLLOW-UPS Why can an ad hoc build only run on registered devices but an App Store build runs anywhere? What happens when a certificate expires or is revoked? Where is the profile stored inside the .app bundle?

ONE CONCRETE EXAMPLE You build a development version. Xcode signs the binary with your development certificate. The embedded provisioning profile names your App ID com.example.app, lists that certificate as valid, and includes your iPhone's UDID. On the device, iOS confirms the signature was made by an allowed certificate, the bundle ID matches, the entitlements are sanctioned, and the device UDID is in the profile, so it launches. Install it on an unregistered phone and iOS rejects it because that UDID is absent from the profile.