Hello, I am experiencing persistent ITMS-90034 when trying to upload the first iOS app from a newly enrolled Individual Apple Developer Program account. The exact error is: Validation failed (409) Missing or invalid signature. The bundle at "Payload/[App].app" is not signed using an Apple submission certificate. (ID: 90034) I have already performed extensive signing checks and troubleshooting: Apple Developer Program membership is active. A valid Apple Distribution certificate is installed in Keychain together with its private key. security find-identity -v -p codesigning reports both Apple Development and Apple Distribution as valid identities. The correct Team and Bundle ID are selected. Automatic signing is enabled in Xcode. Provisioning profile caches and DerivedData were deleted, profiles were downloaded again, and a completely fresh archive was created. Xcode's App Store Connect export review explicitly shows: Certificate: Apple Distribution App Store provisioning profile for the correct Bundle ID get-task-allow = false beta-reports-active = true I then exported the IPA locally using Xcode's App Store Connect distribution workflow and independently inspected the actual exported binary with codesign. The main application reports: Identifier=[Bundle ID] Authority=Apple Distribution: [Name] ([Team ID]) Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA TeamIdentifier=[Team ID] I also separately checked the embedded Capacitor.framework and Cordova.framework. Both are signed with the same Apple Distribution identity and Team ID and show the same WWDR -> Apple Root CA trust chain. I checked Keychain as suggested in similar forum discussions. The Apple Distribution certificate has its private key, the WWDR intermediate certificates are present and valid, and certificate verification reports: "...certificate verification successful." Despite all of the above, a fresh upload from Xcode Organizer still consistently fails with the same ITMS-90034. This appears very similar to other recent reports involving newly enrolled Individual Developer accounts where correctly signed binaries are rejected by App Store Connect. I also opened an Apple Developer Support case (case 20000149684934). So far I have received general signing/troubleshooting documentation, but the issue remains unresolved. At this point, is there any additional local signing verification I should perform, or could this indicate an account/team-level App Store Connect signing validation issue that needs to be investigated on Apple's side? I would especially appreciate guidance from Apple DTS on what diagnostic information would be useful to distinguish a local certificate-chain issue from an App Store Connect/account-side validation issue. Thank you.

Since my Apple Distribution signing certificate had expired I recently got a new one via https://developer.apple.com/account/resources/certificates/list and installed in on my login keychain. Since I had some issues with signing I suspected that codesign might still be trying to use an old expired certificate (as they have the same name "Apple Distribution: ()"). So to fix this I figured I could just delete the old expired certificate from Keychain Access so there was only the valid new certificate there with the same name. However, after doing this and trying to use it with codesign I get the following error error: The specified item is no longer valid. It may have been deleted from the keychain. In other words it seems it's not finding the new valid certificate and somehow still linking the name to the old certificate that it rightly guesses is removed. Following the tips from https://developer.apple.com/forums/thread/701514 I used security find-identity -p codesigning -v to check for installed codesigning certificates, and this listed the new certificate as expected. Using another tip in the same post I saw that you can also use the certificate hash as an identifier beside the name, and using this I can use it with codesign to sign. However, it's still not finding it via the name (or rather, it's still finding the old now removed one). What could be the reason for codesign not finding the correct new valid certificate based on the name and instead still finding the old one? Maybe there's some reference set somewhere to point the name towards specifically the old certificate?

Hi, Developer ID notarization from our team has been broken for two days. Submissions sit in In Progress for hours and never finish, and an earlier batch disappeared from notarytool history entirely without ever reaching Accepted or Invalid. This is blocking a release. Team ID: UFB3325L3Q (Shenzhen Minimal Future Technology Co., Ltd.) First batch (submitted 2026-09-09 ~02:15 UTC) — now VANISHED: CowAgent-2.1.8-arm64.dmg — id 4df22081-b3dd-41fe-b6d5-cebbd3ab40ff CowAgent-2.1.8-x64.dmg — id 6b2bfdee-1b56-4da5-a107-c6184c5695a7 These two sat In Progress for 8+ hours, then silently disappeared from notarytool history. They never returned Accepted and never returned Invalid — the records are simply gone. Second batch (rebuilt & resubmitted 2026-09-10 ~04:36 UTC) — currently stuck In Progress: CowAgent-2.1.8-arm64.dmg — id 8fb34878-ebf2-4efc-8366-223169dc053a — submitted 2026-09-10T04:36:33Z CowAgent-2.1.8-x64.dmg — id 5f306801-32fc-42e1-987b-6c0799bac510 — submitted 2026-09-10T04:39:39Z The packages are correctly signed. Local verification passes every check: codesign --verify --deep --strict returns "valid on disk" and "satisfies its Designated Requirement" Hardened Runtime enabled (flags=0x10000(runtime), Runtime Version 14.0.0) Authority=Developer ID Application: Shenzhen Minimal Future Technology Co., Ltd. (UFB3325L3Q), full chain to Apple Root CA Secure timestamp present All embedded Mach-O binaries (Electron frameworks/helpers plus ~180 PyInstaller backend binaries) are signed inside-out These packages are essentially identical in size and structure to our previous release 2.1.7, which notarized within minutes. In fact 2.1.8 is about 1 MB smaller than 2.1.7 (arm64 dmg 214.2 MB vs 215.3 MB; x64 dmg 223.3 MB vs 224.5 MB), so this is not a large or unusual upload. Our previous releases from this same Team ID (2.1.7, 2.1.7-alpha, and a related app) all notarized within minutes and were Accepted. xcrun notarytool log returns "Submission log is not yet available" for the stuck ones (processing never completes). The Developer ID Notary Service system status shows green (no events) the entire time. The combination of (a) submissions vanishing from history without a verdict and (b) every new submission from this team getting stuck, while the packages verify cleanly and match a previously-accepted release, looks like an account-level backend issue rather than a package problem. Could a DTS engineer please look at the backend logs for Team ID UFB3325L3Q and either release the queue or tell me what is blocking these submissions? Thank you.

Two notarization submissions have been stuck in "In Progress" for over 20 hours with no result. These are the first notarization submissions ever made by this developer account (Team ID: VZUUDKF3MW). Submission IDs: e2fff6a7-f270-421f-abc9-2419b00fc18c (submitted 2026-09-09 03:43:17 UTC) 2eef5754-1e0f-4de2-be32-9c3ee4fdd7b4 (submitted 2026-09-09 06:17:21 UTC) xcrun notarytool info <id> still returns: status: In Progress xcrun notarytool log <id> returns: "Submission log is not yet available or submissionId does not exist" Steps to reproduce: Sign a self-contained app bundle with a Developer ID Application certificate, hardened runtime (--options runtime), and a secure timestamp. Verify: codesign --verify --deep --strict passes; spctl -a -t exec reports "Unnotarized Developer ID" (expected pre-notarization state). ditto -c -k --sequesterRsrc --keepParent "MyApp.app" upload.zip xcrun notarytool submit upload.zip --keychain-profile <profile> --wait The command waits indefinitely. Status never leaves "In Progress". Expected: notarization completes within a few minutes. Actual: "In Progress" for 20+ hours, no log produced, no error returned. The notarytool credentials are valid (xcrun notarytool history succeeds). The signature meets all documented prerequisites. This appears to be a backend processing delay affecting first-time submissions from a newly enrolled team.

Your development team has reached the maximum number of registered iPhone devices. I am use the free provisioning file. So how can I delete old device and use my new iPhone to develop my app. only way is use a paid account? or register a new Apple ID?

I have a DriverKit system extension (dext) that uses PCIDriverKit. I would like to get the build environment straightened out to successfully distribute the dext and associated software to end users. There are three types of software involved: The Dext-hosting application - this is the application that must be installed to /Applications/, and will perform the registration of the dext. The dext is deployed "within" this application, and can be found in the /Contents/Library/SystemExtensions folder of the app bundle. The dext itself - this is the actual binary system extension, which will be registered by its owning application, and will operate in its own application space independent of the hosting application. Additional applications that communicate with the dext - these are applications which will connect to the dext through user clients, but these applications do not contain the dext themselves. There are multiple locations where settings need to be exactly correct for each type of software to be signed, provisioned, and notarized properly in order to be distributed to users: developer.apple.com - where "identifiers" and "provisioning profiles" are managed. Note that there are differences in access between "Team Agent", "Admin", and "Developer" at this site. Xcode project's Target "Signing & Capabilities" tab - this is where "automatically manage signing" can be selected, as well as team selection, provisioning profile selection, and capabilities can be modified. Xcode project's Target "Build Settings" tab - this is where code signing identity, code signing development team, code signing entitlements file selection, Info.plist options and file selection, and provisioning profile selection. Xcode's Organizer window, which is where you manage archives and select for distribution. In this case, I am interested in "Developer ID" Direct Distribution - I want the software signed with our company's credentials (Team Developer ID) so that users know they can trust the software. Choosing "automatically manage signing" does not work for deployment. The debug versions of software include DriverKit (development) capability (under App ID configuration at developer.apple.com), and this apparently must not be present in distributable provisioning. I believe this means that different provisioning needs to occur between debug and release builds? I have tried many iterations of selections at all the locations, for all three types of binaries, and rather than post everything that does not work, I am asking, "what is supposed to work?"

Team: TS447Y97LA Please help identify the underlying failure for two automatic Xcode Developer ID submissions: a904af7c-751d-4e79-9f16-f71f16163ad5 — received SHA-256 a185ebe3860985d0e5f6a07e00348008687a636731a88033d620e3cb3f9ec6aa, 9,454,788,726 bytes. 1f55d5d3-f96f-47d5-ba91-b7372c213ad7 — received SHA-256 efe2aaa7c3714c68d82d4efc1eab9f14c9cc0751ef78c9b3a0856f1b53757ece, a fresh signing/export attempt. Both logs return Invalid/4000 and name these arm64 paths: Pelican.app/Contents/MacOS/Pelican Pelican.app/Contents/XPCServices/PelicanInference.xpc/Contents/MacOS/PelicanInference For the first submission only, we retained the exact Xcode upload ZIP and submitted app. Independent full comparison confirmed the received hash, all 117 ZIP members, and every app resource and metadata entry. There are 115 matching app entries plus two consistent Apple ZIP metadata entries. Python and installed libarchive independently reproduce identical bytes, CRCs, types and permissions. Raw local/central records, ZIP64 values, ranges and footer are consistent; there are no data descriptors or symlinks. The extracted host and all three XPC services pass deep, strict, all-architecture local codesign verification with exact Apple/Team/Developer-ID requirements. Earlier retained code-page, CMS and timestamp-binding diagnostics also passed. These local checks do not override the notary result. The second submission has not received the first submission's full independent ZIP comparison. The inference model contains one 5,349,771,222-byte stored member requiring ZIP64 sizes. Later Methods and host metadata also require ZIP64 offsets. We have not established this as a cause, or inferred success for code parts absent from the issue list. Which exact object and verifier stage failed: the named Mach-O CodeDirectory/CMS, an enclosing resource seal, or archive extraction? Is there a specific error code or documented resource-size limitation relevant to this member? If more evidence is needed, what is the smallest targeted diagnostic? We saw the workflow guidance about excluding huge data from notarization and would like to know whether it applies here before changing the distribution. The separate inert public carrier job, 9e033029-3914-436d-992b-96bd261637de, is now Accepted. At 2026-09-07 18:32 UTC, its exported app passed strict local verification, stapler validation and Gatekeeper assessment as Notarized Developer ID. This confirms the small control succeeded; it does not establish why the larger app failed. The full product remains Invalid. The proposed attachment contains the two issue logs, complete member/hash records, four-part size/signature map and a short result summary. No models, apps, profiles, certificates, credentials, account logs or system diagnostic are attached. The original artifacts can be discussed if a specific follow-up is needed.

Hello, ppq.apple.com appears to be unavailable. The issue is reproducible from multiple networks/devices. Requests to https://ppq.apple.com fail, preventing iOS from verifying developer-signed applications. This results in the device displaying an error indicating that an Internet connection is required to verify the developer/app. The issue appears to be server-side rather than related to the developer certificate or provisioning profile. Affected: (tested on) ppq.apple.com HTTPS / TCP 443 iOS 9.3.4 iPhone 5S [07/09/2026/20:07 + Zurich] Example: curl -I https://ppq.apple.com Response: HTTP/2 404 server: Apple date: Mon, 07 Sep 2026 18:08:13 GMT content-type: text/plain; charset=UTF-8 content-length: 0 x-b3-spanid: bdf368a2edbdbef7 x-b3-traceid: bdf368a2edbdbef7 x-b3-sampled: 1 strict-transport-security: max-age=31536000; includeSubdomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block Please investigate the availability of the PPQ service.

Following up with a full diagnostic summary since my last post, in case it helps narrow this down. Certificates: Developer ID Installer and Developer ID Application (Team ID 6VCLSHAN7R), both freshly created Aug 19, 2026. Both show as valid/trusted in Keychain Access and match the developer portal (expiration 2031/08/20). What I've verified/tried, all pointing to the same conclusion: Local signature is valid. pkgutil --check-signature shows a full chain (Developer ID Installer → Developer ID Certification Authority → Apple Root CA) with a trusted timestamp. codesign -dvv on the embedded binaries (VST3, AU component, standalone app) all show Authority=Developer ID Application: ..., hardened runtime enabled, valid secure timestamp. No account/cert issues found. No duplicate certificates (security find-identity -v -p basic returns exactly 2 valid identities). No pending Program License Agreement. developer.apple.com/system-status shows Notary Service operational. Signed with productsign directly, not just via the packaging GUI (Packages/Whitebox) — same result. Isolated from product content: a minimal pkgbuild test package (single text file, signed only with productsign, no relation to my actual product) fails with the exact same error. Waited 3+ days in case of certificate propagation delay — no change. Tried both authentication methods — Apple ID + app-specific password, and a Team-scoped App Store Connect API key — both fail identically. Every single attempt returns: "message": "The binary is not signed with a valid Developer ID certificate." Latest Submission IDs (all Invalid, same error): 5b495af5-1a31-41cd-b8a3-d1e33ab2a12a (product pkg, API key auth) 91eee4f0-778a-4edb-9515-eabfc6711f3f (minimal test pkg, Apple ID auth) At this point I've ruled out everything on my end I can think of — package contents, signing tool, authentication method, certificate freshness/propagation, account status. This looks like something wrong with how these specific certificates are provisioned on Apple's side for notarization. Could someone from DTS take a look at the account/certificates directly? Happy to provide any further diagnostics needed. Thanks for your patience.

Hi team, Earlier, Apple’s documentation clearly mentioned that we needed to submit a request to Apple to obtain the Location Push Service Extension (com.apple.developer.location.push) entitlement. However, when I checked the Apple Developer Portal now, I don’t see an option to request this entitlement for my App ID. Could you please confirm whether this entitlement is still required to be requested from Apple, or if the process has changed and the request is no longer required? Thanks

When attempting to build an Apple Vision Pro application written in Swift in Xcode, we get the following status errors: "Provisioning profile [Profile Name] doesn't include the Main Camera Access capability.” and "Provisioning profile [Profile Name] doesn't include the com.apple.developer.arkit.main-camera-access.allow entitlement.” The provisioning profile we are attempting to use DOES have the Main Camera Access capability enabled through the Apple Developer portal. We have tried deleting and remaking the profile multiple times, as well as creating new profiles with the same settings, but completely different names and bundle identifiers, but keep getting the same errors. We DO have the "com.apple.developer.arkit.main-camera-access.allow” added to the entitlements file of the Xcode project, and we DO have the “NSMainCameraUsageDescription” key added to the info.plist file, along with the needed string describing the camera usage. Our organization has a valid and active Enterprise account, through which we have requested and been granted access to the “Main Camera Access” capability. We have built this applications multiple times before in the past year with no issues, these errors began after one of our provisioning profiles expired and we re-made it. We have tried clearing the Provisioning Profile Cache on our machine, clearing the Derived Data in the Xcode settings, and clearing the Xcode build cache. We are experiencing these errors on multiple machines, with different versions of our app, and with completely different apps that use the Main Camera Access entitlement. We experience these errors when the profile is downloaded directly in Xcode, and when it is downloaded from a browser and imported into Xcode. When we use “Automatically manage signing” our app properly builds and deploys to the Vision Pro, but when we use the app and attempt to access the main camera, the app crashes with the exception: "Exception: This app failed to request an authorization.” We have searched online forums and found several instances of others that have experienced this problem, but have not found a solution that works. Software Versions: Xcode Version: 26.6 macOS Version: Tahoe 26.5.1 VisionOS Version: 26.5

Free Personal Team, hitting "Your development team has reached the maximum number of registered iPhone devices." I need a local build on a physical device for a demo, so I'm looking for the fastest supported path rather than a fix for the underlying behavior. Context: I hadn't used this Apple ID for development in about two years, so the usual "wait a week for registrations to expire" advice doesn't seem to apply here. The registrations appear to have persisted well past that window. Already tried: removing and re-adding the account in Xcode, clearing ~/Library/Developer/Xcode/UserData/Provisioning Profiles, deleting the developer profile from the device, and confirming this isn't the separate offloaded-apps issue that causes the "maximum number of apps for free development profiles" error. Free accounts have no Devices page, so there's nothing to clear manually. I'm aware of two options: enroll in the Developer Program, or create a new Apple ID and use it as a fresh Personal Team. I've also seen reports of people calling Apple Support and having devices dropped manually, with mixed results. Is the phone call route still viable for someone on a free account, or has that closed? And is there anything else I'm missing before I go the new-Apple-ID route?

Hi everyone, For the past three days I've been unable to notarize my app — every attempt fails with an HTTP 500 error from Apple's notarization service. What's unusual is that the error occurs not only during submission, but also when simply validating credentials via store-credentials. Example: $ xcrun notarytool store-credentials "notarytool-password" \ --apple-id <id> --team-id <team> --password <app-specific-password> Validating your credentials... Error: HTTP status code: 500. Internal Server Error Request ID: K6NYCMIFNM66OI2WRG3ORZEDUE.0.0 Please try again at a later time. Since the failure happens at credential validation — before any package is even uploaded — I'm fairly confident this is a server-side issue, not something wrong with my setup or the binary. I've tried across different network connections, same result. Has anyone else been hitting this? Is there a known outage or incident on Apple's notarization infrastructure? Any way to escalate or get a status update beyond checking developer.apple.com/system-status/? Thanks

I have been trying to use Apple Developer Support to help with issues I'm having preventing me from signing and notarizing my apps. Delayed and not helpful responses from support. This has been going on for several weeks. I find it hard to believe that a Multi-Trillion Dollar company can't help me with my issues. I have what I think is a good certificate and private key as well as my App-Sepcific Password. The problem is that when trying to sign my apps, I get a popup indicating that that it's trying to sign in to Keychain using my first Name (Steve). My login on my system is "Stephen" which works fine for login and anything that wants to access Keychain. I need some help trying to resolve this.

I have two Apple Developer accounts under different Apple IDs: a free "Personal Team" account and a separate paid Organization account. Before my organization's Program enrollment was approved, I built an app to a physical device using Xcode signed into my personal account, which auto-registered an App ID under that personal team. Now that my organization account is active, I can't register the same App ID under the organization — both the web portal and Xcode's automatic signing return "not available," since it's already reserved under my personal team. Since personal (free) accounts have no web portal access, I can't see or manage that registration anywhere to release it myself. I own both accounts. Is there any self-service way to release an App ID from a personal team, or is contacting Apple Developer Support the only option? If support is required, is there a faster route than the standard contact form (I submitted a request several days ago with no reply yet)?

When trying to develop an Apple Shortcut, the shortcut doesn't appear (after many open, quit, adding permissions, etc.). My only Apple Account is my name associated with an Apple ID of QZ99..... However, when I try to check one (of many reasons) why it does not show up with Terminal: codesign -dv --verbose=4 "/Applications/My App.app" etc, it shows something "rejected" Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA Signed Time=Aug 25, 2026 at 1:26:38 PM Info.plist entries=22 TeamIdentifier=QZ99... Runtime Version=26.5.0 Sealed Resources version=2 rules=13 files=4 Internal requirements count=1 size=204 /Applications/Write Create Date from Original.app: rejected origin=Apple Development: My Account (K533...) The K533... is different than my Team ID of QZ99... Could that be a reason my app is not registered with Shortcuts? Is that expected functionality? I guess I expected my Team ID to appear everywhere even after I deleted my account in Xcode, removed a current and expired certificate associated with K533 in Keychain, and then added my account back, and let Xcode regenerate a certificate.

Hi all, I've hit a wall trying to notarize a macOS installer pkg (built with Packages/Whitebox, signed with productsign). Every submission fails with: "message": "The binary is not signed with a valid Developer ID certificate." What's strange: this happens even on a minimal test pkg built with pkgbuild containing a single text file, signed only with productsign — no relation to my actual product. So it's not a content/nested-binary issue. Local verification passes fine: pkgutil --check-signature shows a full valid chain (Developer ID Installer → Developer ID Certification Authority → Apple Root CA) with a trusted timestamp. Both my Developer ID Installer and Developer ID Application certificates were freshly created on Aug 19, 2026, show as valid/trusted in Keychain Access, and match on developer.apple.com (Team ID 6VCLSHAN7R). What I've already tried: Re-created both certificates from scratch Waited 2 days in case of propagation delay Checked for pending program agreements (none) Checked developer.apple.com/system-status (Notary Service shows operational) Verified no duplicate/conflicting certificates in keychain Submitted a DTS support ticket 2 days ago, still waiting on a response. Has anyone run into this exact "valid everywhere except the notary service" situation? Any pointers appreciated. Example submission ID: 91eee4f0-778a-4edb-9515-eabfc6711f3f

I have requested an entitlement for my DriverKit based driver, but the status is still in "Submitted" phase. I have also tried contacting Apple Support by phone/mail but to no avail [Case ID: 20000143721904]. Below are the details of my request. Is there any way to know the turnaround time or to expedite the process as this entitlement is necessary for the distribution of our app? Also, what is the preferrable way to follow up in such cases? Entitlement: com.apple.developer.driverkit.transport.pci - DriverKit PCI (PrimaryMatch) Team: 8S33FS7Q5Q Request Id - NZYWRD96U3 Requested At - August 13, 2026 Type - Team Status - Submitted Thank you, Abishek.

We completed an App Store app transfer and the Notification Service Extension Filtering Entitlement (com.apple.developer.usernotifications.filtering) did not transfer with the app. App Apple ID: 6760007376 NSE Bundle ID: io.nolink.ios.nse New Team ID: M85WA8W78C Previous Team ID: V2E3A94DC9 The app, bundle IDs, and App Store presence all moved normally, but the entitlement is not available on the new team, so we cannot sign the NSE with the configuration the app previously shipped with. Our app is an encrypted messenger and this breaks incoming call handling for live users. Two questions: Is there an official process for re-associating a previously approved entitlement with the receiving team after a transfer, or does the new team always have to submit a fresh request? Could entitlements tied to a specific App ID move with the app during a transfer, the same way bundle IDs do? We have an open support case, but wanted to raise the general question here too.

I use a free Apple Personal Team with Xcode for on-device testing. My Apple Development certificate created on 15 August 2026 shows “Missing Private Key”, and Xcode is not allowing me to create a fresh replacement certificate. I have already contacted Apple Developer Program Support, and they directed me to the Apple Developer Forums for technical assistance. How can I revoke/reset the unusable certificate or clear the certificate state for my Personal Team so that Xcode can create a new Apple Development certificate?