What if the enterprise provisioning profile gets expired, will the apps build with it stops working?

Question

Quick sanity check - I've read through several related questions and I'm still confused about this topic.

I have build the app with a provisioning profile(in-house) with enterprise account. That provisioning profile is getting expired in next few days and the distribution certificate used for that provisioning profile expires in next year. If the provisioning profile gets expires will the apps which were distributed stops working or they will keep working as distribution cert is intact?

Answer 1

The answer is: MAYBE ( but they will probably stop working )

So, the thing you need to realize is that, while your provisioning profile is installed with the app, at install time, it is simply added to the set of installed profiles on the device. When you go to run an app, iOS simply checks if there is a valid profile that works for the app. It doesn't have to be the one installed with the app.

So, let's say you have an enterprise provisioning profile that uses a wildcard app ID. You install your app (app A) with a provisioning profile that is set to expire on 4/12/2020. If that is the only enterprise app you have on the device, and you do not install a new provisioning profile through another means (like MDM - mobile device management), the app will not run on 4/13.

However, let's say your organization uses a wildcard id in their provisioning profile, and you (or another team) builds a second app (app B) that is installed afterwards, but it is installed with a provisioning profile that is set to expire on 1/1/2021. If that app is installed on the same device as app A, when the user launches app A, and it will check for a valid provisioning profile on the device, find the one installed with app B, and be allowed to run. This scenario is likely why @Shubham thinks that the app will continue to run - he has probably experienced this, but thought it was due to the certificate expiration. It definitely was NOT!

So, I would recommend you get a new provisioning profile installed on devices running those apps as soon as possible. The easiest way to do that is to create a new build of the app with the new provisioning profile and install the new version. If these are managed devices and your MDM software allows it, you could simply install a new provisioning profile directly.

But, whatever you do, don't believe that you don't need to worry about it because the certificate is still good. You need to get a newer profile on your devices or you will have a lot of apps that appear to crash on start up. Believe me, I've been there.

However, when you get close to the certificate expiring, you will definitely need to rebuild a new binary, so plan ahead for that. Pushing a new profile onto the device won't work then, because the binary on the device is signed with the cert, so the only way to fix an expired cert is to build a new binary signed by the new cert.

Answer 2

Your enterprise app needs to contain a valid provisioning profile. This means that it will need to be updated at least once every 12 months.

If your enterprise app is distributed by MDM then you can use your MDM to distribute a new provisioning profile without updating the entire app. A new app version will be required at least once every 2 years as the signing certificate will expire.

For more information refer to this 2014 WWDC session - Transcript

It was also covered briefly in this 2019 WWDC Session