xcode 无法在 Ad Hoc 配置文件到期前续订，因为没有证书与证书 ID 匹配

Cannot renew an Ad Hoc profile before it expires because no certificate matches the certificate ID

提问by user278859

My Ad Hoc profile is about to expire in 14 days. There is a a "renew" button for my ad hoc profile in the organizer but when I click it I get...

我的 Ad Hoc 个人资料即将在 14 天后到期。在组织者中我的临时个人资料有一个“更新”按钮，但是当我点击它时，我得到...

There are no current certificates on this team matching the provided certificate IDs.

此团队中没有与提供的证书 ID 匹配的当前证书。

The profile in the provisioning portal shows active, expiring on the 30th. I also see a distribution certificate with the same expiration date. I must assume that this certificate is the one that was used to sign the profile. Is there any way to fix this without revoking and creating a new ad hoc profile and certificate?

配置门户中的配置文件显示为活动状态，将于 30 日到期。我还看到了具有相同到期日期的分发证书。我必须假设此证书是用于签署配置文件的证书。有没有办法在不撤销和创建新的临时配置文件和证书的情况下解决这个问题？

If I have to start over, what is the best way to proceed without messing up my testors.

如果我必须重新开始，那么在不弄乱我的测试人员的情况下进行的最佳方法是什么。

There are a lot of posts and answers on this subject but I can't find any that address this particular problem with the certificate not matching the certificat ID of the profile.

有很多关于这个主题的帖子和答案，但我找不到任何解决这个特定问题的证书与配置文件的证书 ID 不匹配。

回答by Bryan Musial

Ad-Hoc Provisioning Profiles are composed of three main elements:

Ad-Hoc 配置文件由三个主要元素组成：

• Exactly 1 AppID
• The Public Key of your Distribution Certificate
• One or more Registered Test Device IDs

• 正好 1 个 AppID
• 您的分发证书的公钥
• 一个或多个注册测试设备 ID

When you first generated this Provisioning Profile (about a year ago if your current one is expiring soon!), you instructed it to use your then current Distribution Certificate when constructing that provisioning profile -- the resulting Ad-Hoc Profile's expiration date is set to match the expiration of the Distribution Certificate as you can't launch an app signed with an expired certificate (Aside: This doesn't necessarily apply in Jailbroken scenarios...)

当您第一次生成此配置文件时（大约一年前，如果您当前的配置文件即将到期！），您指示它在构建该配置文件时使用当时的分发证书——生成的 Ad-Hoc 配置文件的到期日期设置为匹配分发证书的过期时间，因为您无法启动使用过期证书签名的应用程序（旁白：这不一定适用于越狱场景......）

Your main question of 'Can it be fixed without revoking?' is a solid 'No' -- Even if you could make adjustments, the soon-expiring Distribution Certificate would cause the newly reissued Ad-Hoc Profile to have an expiry matching that of the Distribution Certificate. You'll be back in this same situation in 14 days when both your certificate and Provisioning Profile have both expired. Unfortunately at that time you'll also have a new problem, any existing builds you have out to your testers will no longer launch as the signing certificate and provisioning profile will have lapsed.

您的主要问题是“可以在不撤销的情况下修复吗？” 是一个可靠的“否”——即使您可以进行调整，即将到期的分发证书也会导致新重新颁发的 Ad-Hoc 配置文件的到期时间与分发证书的到期时间相匹配。当您的证书和配置文件都已过期时，您将在 14 天后回到同样的情况。不幸的是，届时您还会遇到一个新问题，您提供给测试人员的任何现有构建都将不再启动，因为签名证书和配置文件将失效。

Instead, these last two weeks are your opportunity to be proactive and get your users migrated to a new build with a new Certificate and Provisioning Profile. With my own testers, I treat the last few weeks of my current Distribution Certificate as a migration window to get builds switched over and get my testers to download and install the latest test build so that they can keep going with their testing. The great news is that you caught your certificates expiring with more than enough time to get things straightened out and get your testers migrated -- some aren't so lucky and have to play catchup after things have expired and have testers shouting about your app crashing/no longer launching...definitely an undesirable outcome for any developer, especially if you are a one-person shop and having to coordinate both development and beta tester communications yourself.

相反，这最后两周是您积极主动并让您的用户迁移到具有新证书和配置文件的新版本的机会。对于我自己的测试人员，我将当前分发证书的最后几周视为迁移窗口，以切换构建并让我的测试人员下载并安装最新的测试构建，以便他们可以继续进行测试。好消息是，您发现您的证书过期时间足够让事情理顺并让您的测试人员迁移——有些人没那么幸运，在事情过期后不得不追赶，并且让测试人员大喊您的应用程序崩溃/ 不再启动......对于任何开发人员来说绝对是一个不受欢迎的结果，

So what do I have to do?

那我该怎么办？

At a high level, doing the migration is nearly identical to getting this Ad-Hoc profile setup the first time -- It just requires cleaning up the old data from your Keychain and Provisioning Profiles as well as sending out some tester emails encouraging your team to upgrade once you make a new build available to them. At a high level this process looks like this:

在高层次上，进行迁移与第一次设置此 Ad-Hoc 配置文件几乎相同——它只需要清理钥匙串和配置文件中的旧数据，并发送一些测试人员电子邮件，鼓励您的团队一旦您为他们提供新版本，就升级。在高层次上，此过程如下所示：

1. Revoke your existing Distribution Certificate and reissue a new Distribution Certificate.
2. Delete the existing Distribution Certificate from your Keychain and install the new one.
3. Update and install the now 'Invalid' Ad-Hoc profile to use your newly created Distribution Certificate
4. Update Code Sign Build Settings if necessary.
5. Construct and issue your Ad-Hoc build to your testers.

1. 撤销您现有的分发证书并重新颁发新的分发证书。
2. 从您的钥匙串中删除现有的分发证书并安装新的。
3. 更新并安装现在“无效”的 Ad-Hoc 配置文件以使用您新创建的分发证书
4. 如有必要，更新代码签名构建设置。
5. 构建并将您的 Ad-Hoc 构建发布给您的测试人员。

Wait -- Won't revoking my existing certificate disrupt my testers?

等等——撤销我现有的证书不会干扰我的测试人员吗？

Nope, not in the least bit! Your existing Ad-Hoc builds will continue to work perfectly well until after the expiration date because they have all the information they need to verify code signatures right inside the Ad-Hoc build you've already sent them. Once the certificate expires, however then things will fail to launch and you'll have screaming testers on your hands.

不，一点也不！您现有的 Ad-Hoc 构建将继续完美运行，直到过期日期之后，因为它们在您已发送的 Ad-Hoc 构建中拥有验证代码签名所需的所有信息。但是，一旦证书过期，事情将无法启动，并且您手上会有尖叫的测试人员。

I'm going to assume that you are using an Individual account, so certificates will appear in the format "iPhone Developer: FirstName LastName" and "iPhone Distribution: FirstName LastName". If you are using a Company Account, then the format will be slightly different. I'm also going to assume that you only have your one account; if you are enrolled in multiple developer accounts, take extra care when searching for and deleting your existing certificates and profiles from Keychain as there may be multiple similar entries.

我将假设您使用的是个人帐户，因此证书将以“iPhone 开发人员：名字姓氏”和“iPhone 分发：名字姓氏”的格式显示。如果您使用的是公司帐户，则格式会略有不同。我还将假设您只有一个帐户；如果您注册了多个开发者帐户，则在从 Keychain 搜索和删除现有证书和配置文件时要格外小心，因为可能有多个类似的条目。

To begin, quit out of Xcode and then head over to developer.apple.com/ios login to the "Certificates, Identifiers & Profiles" area. This is formerly known as the "Provisioning Center".

首先，退出 Xcode，然后前往 developer.apple.com/ios 登录“Certificates, Identifiers & Profiles”区域。这以前称为“供应中心”。

Revoking and Reissuing the Distribution Certificate

吊销及补发经销证

1. Navigate to the Distribution Certificates Area.
2. Locate your soon-to-expire Distribution Certificate and revoke it. You'll likely encounter a message informing you that revoking this certificate will invalidate any linked provisioning profiles -- that is entirely expected and OK. In fact, that is exactly what we want it to do so that you can get things updated!
3. Click the 'Add' button in the upper right corner and walk through the steps to make a new "App Store and Ad Hoc" Distribution Certificate. Download the file to your machine, but don't install it just yet -- we should clean up the old certificate from your Development Machine first.

1. 导航到分发证书区域。
2. 找到您即将到期的分发证书并将其撤销。您可能会遇到一条消息，通知您撤销此证书将使任何链接的配置文件无效——这完全符合预期并且可以。事实上，这正是我们想要它做的，以便您可以更新内容！
3. 点击右上角的“添加”按钮，按照步骤制作新的“App Store and Ad Hoc”分发证书。将文件下载到您的机器上，但不要立即安装——我们应该先从您的开发机器上清除旧证书。

Deleting the Revoked Certificate and Installing the New Certificate

删除吊销证书并安装新证书

1. Open Keychain Access and search for 'iPhone Distribution'.
2. Delete any blue certificates that match 'iPhone Distribution'. The certificate icon may also show a red 'X' indicating that it is either expired or revoked. These may be cleaned up as well as they are no longer of use.
3. Double-click the newly downloaded certificate and install it.

1. 打开 Keychain Access 并搜索“iPhone Distribution”。
2. 删除与“iPhone Distribution”匹配的所有蓝色证书。证书图标还可能显示一个红色的“X”，表示它已过期或已被撤销。这些可能会被清理掉，也可能不再使用。
3. 双击新下载的证书并安装。

Edit the Ad-Hoc Provisioning Profiles

编辑 Ad-Hoc 配置文件

1. Navigate to the Distribution Provisioning Profiles section and locate your Ad-Hoc Profile.
2. Edit that profile updating the test device list if necessary.
3. Click Generate and download the newly created Provisioning Profile. If the Generate button is disabled check that there are no special characters in the Provisioning Profile's name and that you've selected at least one test device.
4. Drag and drop the newly downloaded provisioning profile on to Xcode. Any old versions of the profile may be deleted from Organizer.

1. 导航到 Distribution Provisioning Profiles 部分并找到您的 Ad-Hoc Profile。
2. 如有必要，编辑该配置文件以更新测试设备列表。
3. 单击 Generate 并下载新创建的 Provisioning Profile。如果 Generate 按钮被禁用，请检查 Provisioning Profile 的名称中是否没有特殊字符，并且您至少选择了一个测试设备。
4. 将新下载的配置文件拖放到 Xcode 上。可以从管理器中删除配置文件的任何旧版本。

At this point you should be back in business and ready to update Code Sign settings if necessary (that is, if you set them to match a specific profile instead of using the Automatic Profile Selector option you'll need to update that setting to point to the now current version of your Provisioning Profile).

此时，您应该可以重新开始工作并准备好在必要时更新代码签名设置（也就是说，如果您将它们设置为匹配特定配置文件而不是使用自动配置文件选择器选项，则您需要更新该设置以指向您的配置文件的当前版本）。

Again, you are fortunate in that you are taking steps to get this issue fixed while you testers are still able to use your app and not having to rush or hurry to get this done. Take your time and make sure to cleanup the older certificates and expiring provisioning profiles to make it easier for Xcode to figure out that you want it to use the newest profile.

同样，您很幸运，因为您正在采取措施解决此问题，而您的测试人员仍然可以使用您的应用程序，而不必急于完成这项工作。花点时间确保清理旧证书和过期的配置文件，以便 Xcode 更容易确定您希望它使用最新的配置文件。