When uploading to the App Store, ITMS-90035 is a typical signing error. Many people first assume the IPA is corrupted, but in reality, this error is more related to certificates, provisioning profiles, signing methods, and export methods.
Especially in scenarios like Flutter, uni-app, React Native, HBuilderX, and Jenkins automated builds, this error is more likely to occur.
What is ITMS-90035
The error message typically looks like ERROR ITMS-90035: Invalid Signature or This bundle is invalid.
Apple indicates that the uploaded IPA failed signature verification.
Where Does the Error Occur
First, distinguish:
Stage Belongs to ITMS-90035? Xcode Archive failed No IPA installation failed Not necessarily Rejected by Apple after upload Yes Processing failed Very likelyMost Common Issue: Certificate Type Mismatch
This is the most frequent situation in real projects.
For example, using a Development certificate while the upload target is App Store. In this case, the IPA can be generated and may install on a device, but the upload fails.
The correct approach is that uploading to the App Store requires:
Type Purpose iOS Distribution App Store distribution App Store Profile App Store uploadAnother frequent issue: provisioning profile and certificate mismatch, for example:
Item Actual Type Certificate Distribution Profile DevelopmentOr the reverse.
How to Check the Provisioning Profile
Open the .mobileprovision file and focus on:
Check If Bundle ID Is Consistent
An easily overlooked issue: the App ID in the profile does not match the actual Bundle ID used for packaging. For example, profile: com.demo.app, but actual: com.demo.test. Apple will directly deem the signature invalid during upload.
Typical Issues in uni-app Scenarios
In HBuilderX cloud packaging, it’s common to see the app identifier in the profile file not matching the package name. The reason is that manifest.json, Bundle ID, and mobileprovision are inconsistent.
Regenerating Certificates
The more time-saving approach to these issues is to regenerate the entire signing chain, including the Bundle ID, certificate, and provisioning profile.
To regenerate in the Windows environment, you can directly use AppUploader, which allows you to manage Bundle IDs, create Distribution certificates, generate App Store provisioning profiles, and upload IPAs in Windows, without relying on Xcode or Keychain.
Step 1: Confirm the Bundle ID
For example, com.company.app, ensure the Apple developer portal, packaging configuration, and Profile are all consistent.
Step 2: Recreate the Distribution Certificate
Do not continue using the old Development certificate.
Step 3: Recreate the App Store Profile
Be careful not to select the Development type.
Step 4: Re-export the IPA
If using Xcode Export → App Store Connect, do not choose Ad Hoc.
Issues in Jenkins / Fastlane Scenarios
In CI environments, it’s common to have the certificate present but the private key missing. This manifests as successful uploads locally but failures in Jenkins, due to an incomplete P12.
So you need to verify whether the IPA is actually signed correctly.
Unzip the IPA with the command: unzip app.ipa, then check Payload/App.app to see if _CodeSignature and embedded.mobileprovision exist.
Issues Caused by Upload Tools
Recently, Apple has been stricter about legacy upload protocols. If you see Deprecated Transporter usage, it means the upload tool is outdated or the Transporter protocol has been deprecated.
In this case, upgrade the upload tool or use a new upload channel.
CLI Upload Makes Log Diagnosis Easier
Many errors are hidden in GUI uploads, while CLI makes it easier to see complete logs for metadata, transporter, signing, and upload session. For example:
appuploader_cli upload
-f app.ipa
-u [email protected]
-p xxxx-xxxx-xxxx-xxxx
--type ios
Enter fullscreen mode Exit fullscreen mode
Finally, the issues can be summarized as:
Type Frequency Incorrect certificate type Very high Incorrect Profile type Very high Bundle ID mismatch Very high Missing private key Medium Outdated upload protocol Medium Corrupted IPA LowITMS-90035 essentially means Apple is verifying whether the IPA has a legitimate and complete signature. Therefore, the troubleshooting focus is not on the “upload button” but on whether the certificate, provisioning profile, Bundle ID, and export method are consistent.
답글 남기기