I have come to the beginning of a new year on my developer license with Apple. At this time I am able to remove old devices from the account:

enter image description here

Unfortunately there are several applications that are deployed to testers that have those old devices on the provisioning profiles. When I remove the old device UDID's the provisioning profiles with the removed UDID's will be invalid. Does this mean that at some point, my testers' apps will phone home and stop working until I can redeploy with regenerated provisioning profiles? Or will they just keep working until their profile expires?

Effectively, I think I'm asking if Apple maintains a revocation list for provisioning profiles as well as signing certificates, and if deletion of a device would trigger revocation.

  • You can remove the devices from the profile that you have purged and then the profile should be good.
    – MwcsMac
    Sep 24, 2015 at 16:38
  • 1
    @MwcsMac I understand that, but I'm wondering if apps deployed with the now-invalid provisioning profiles will break. Redeploying with a new provisioning profile before the next test release would be expensive for me.
    – jpheldson
    Sep 24, 2015 at 17:01

1 Answer 1


I don't think that Apple reaches out and revokes certificates on devices when you wipe the slate clean, but they would be in their right to do so and they have the capability to do so.

Most likely, those devices will work until a certificate (or intermediate in the trust chain) expires. Or until the "testers" remove the app or wipe the device or remove the trust profile.

  • I do recall reading somewhere in Apple's documentation (I wish I could find it now) that iOS will cache it's code signing trust chains for 3-7 days, or until the device is restarted, at which time, if the network is available, it will re-establish it's trust chains. At that point, any certificate revocations are detected. I know this is what they say, and have tested it. What I don't know is if they revoke the provisioning profiles as UDID's are removed from the account. Do you have any documentation to support this answer? That would be really helpful.
    – jpheldson
    Sep 24, 2015 at 20:06
  • No - just a hunch and that I've never seen revocation traffic when I'm watching the network. I would be safe and plan to either not revoke or re-enroll testers.
    – bmike
    Sep 24, 2015 at 20:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .