iOS Provisioning Profiles and Signing Certificates

WHAT THIS TESTS The interviewer wants to know whether you understand Apple's code-signing trust chain, which trips up many React Native developers when builds fail to install or upload.

A GOOD ANSWER COVERS A signing certificate is issued by Apple and pairs with a private key on your machine; signing the app with it proves the binary came from a trusted developer. An App ID identifies the app uniquely, either an explicit bundle identifier like com.company.app or a wildcard, and it declares which capabilities and entitlements the app may use. A provisioning profile is the document Apple generates that binds together one or more certificates, a specific App ID, the entitlements, and for development builds a list of registered device UDIDs. At install or build time iOS checks that the binary is signed by a certificate referenced in the profile, that the bundle id matches the App ID, and that the device is allowed.

COMMON WRONG ANSWERS Saying the certificate and profile are the same artifact. Claiming App Store distribution profiles list device UDIDs; they do not. Forgetting that entitlements such as push notifications must be enabled on the App ID before the profile will carry them.

LIKELY FOLLOW-UPS Difference between development, ad hoc, and App Store distribution profiles. What Fastlane match does to share certificates across a team. Why a build fails with a provisioning profile mismatch error.

ONE CONCRETE EXAMPLE You create an App ID com.acme.app with push enabled, generate a distribution certificate, then create an App Store provisioning profile linking that certificate and App ID. Xcode signs the archive with the certificate, embeds the profile, and the upload to App Store Connect succeeds because the bundle id, entitlements, and certificate all match what the profile authorizes.