iOS · build & submit

No signing certificate “iOS Distribution” found

No signing certificate "iOS Distribution" found
No code signing certificates are available to use
No profiles for 'com.your.app' were found

The short answer

Xcode found no complete signing identity in the keychain it is searching. A certificate alone does not count — it needs the certificate and its private key, which together form an identity.

List what is actually available:

security find-identity -v -p codesigning

An empty list, or one containing only development identities when you are building for distribution, is your answer. From there:

Nothing listed at all — import your .p12, and confirm it contains a private key (see certificate not imported).
Only development identities — you have an Apple Development certificate and need an Apple Distribution one. They are different certificate types and one cannot stand in for the other.
Correct identity listed, still failing — the build is almost certainly searching a different keychain. See below.

Why this happens

The vocabulary is what makes this hard to search for. Three things get called "certificate" in casual use:

The certificate — a public document naming you and your team.
The private key — generated on your machine, never leaves it, and is what actually signs.
The identity — both of the above, together, in a keychain. This is the only one codesign can use, and the only one find-identity lists.

So "I definitely have the certificate installed" and "there is no signing identity" are routinely both true at once, and the error is technically accurate while sounding wrong.

Development is not distribution

Apple issues distinct certificate types for running on your own devices versus shipping to the store. A project set to a distribution export method will not accept a development identity, even though both appear under the same section of the developer console and have similar names. If find-identity shows only Apple Development, no amount of keychain repair will help — you need to issue an Apple Distribution certificate.

Why CI fails when your Mac does not

Locally, your identity sits in the login keychain and everything finds it. A build machine has no login keychain worth speaking of, so the identity has to be imported into a keychain that is created, unlocked, and added to the search list for that build. Miss any of those three and codesign reports exactly this error, because from its point of view the identity genuinely is not there.

The extra step people miss is the search list. An imported, unlocked keychain that has not been added with security list-keychains -s is invisible.

Catching it before you build

Rather than asking the keychain what is installed, a preflight can ask whether the exact files this build will use are complete and consistent — which is the question that actually determines whether signing will work, on your machine or a runner:

▸ iOS
  ✗ Host                        linux — iOS builds need macOS
      → Build with --cloud, or run on a Mac. Apple's EULA allows no third option.
  ✓ Distribution certificate    Apple Distribution: Kaya Labs — valid until 2027-09-25

Set up leas in 10 minutesFree, MIT licensed, and it never receives your signing keys.

If that didn’t fix it

find-identity lists it and the build disagrees. The build is searching a different keychain. Confirm with security list-keychains -d user that the one holding the identity is in the list.
It appears after import and vanishes later. A keychain that was created and unlocked but never had its lock timeout adjusted will re-lock mid-build.
Everything is present and the export still fails. Check the export method matches the profile type — an ad-hoc profile cannot produce an app-store export.