Xcode Cloud export fails with exit code 70: "Developer ID Application Managed" certificate exists but Xcode Cloud reports no cert/private key found

Developer Tools & Services Xcode Cloud
sktusing OP
Created
Replies 4
Boosts 1
Views 171
Participants 3

We're getting a build failure from Xcode Cloud on the Export Archive step for the Developer ID distribution destination. The App Store Connect and Development exports in the same build both succeed, only the Developer ID export fails.

Environment

  • Xcode 27.2 (27B48), macOS SDK 27.2
  • Build: Vor (macOS), Build 1270
  • Team ID: BB23FH7873

When Xcode Cloud queries for a certificate of type DEVELOPER_ID_APPLICATION_MANAGED zero results are returned:

Payload: {"urlEncodedQueryParams":"teamId=BB23FH7873&filter[certificateType]=DEVELOPER_ID_APPLICATION_MANAGED&limit=200"}
Response: { "data" : [ ], "meta" : { "paging" : { "total" : 0 ... } } }

It then attempts to create one, which is rejected:

POST .../certificates  {"certificateType":"DEVELOPER_ID_APPLICATION_MANAGED","teamId":"BB23FH7873"}

Response:
{
  "errors" : [ {
    "status" : "409",
    "code" : "ENTITY_ERROR",
    "resultCode" : 7460,
    "title" : "There is a problem with the request entity",
    "detail" : "You already have a current Developer ID Application Managed certificate or a pending certificate request."
  } ]
}

The export step then fails with:

error: exportArchive No signing certificate "Developer ID Application" found
  No "Developer ID Application" signing certificate matching team ID "BB23FH7873" with a private key was found.

error: exportArchive No profiles for 'app.getvor.macOS' were found
  Xcode couldn't find any Developer ID provisioning profiles matching 'app.getvor.macOS'.

** EXPORT FAILED **

xcodebuild -exportArchive then exits with status 70.

We have two Developer ID Application Managed (Xcode Cloud) certificates already in Certificates, Identifiers & Profiles, and no certs pending that we can see. So it looks like something is preventing Xcode Cloud from seeing its own previously created managed certificates.

Is there a way to get Xcode Cloud to recognize the existing certificates? Other posts suggest revoking existing Developer ID Application certificates, however our understanding is this has the potential to break currently signed and shipped versions of the application.

A version of this question was also submitted as case ID 103008361082.

Replies  4
Boosts 1
Views  171
Participants  3
DTS Engineer OP
Apple

I recently saw an Xcode Cloud thread [edit: fixed the URL] that looks very like this one.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
sktusing OP

Hey Quinn-

I also saw a thread with an issue similar to this, but am looking for confirmation from DTS about the steps to take, and that this will not break currently signed and shipped versions of the app.

Cheers!
Michael Coding Monkey OP

Same failure here, Team 4G35KLFD64, macOS app Kaleidoscope, Xcode Cloud builds 11017, 11020 and 11021 (Nov 3–4). App Store and Development exports in the same builds succeed; only the Developer ID export fails.

From the export logs:

  • The certificate query for DEVELOPER_ID_APPLICATION_MANAGED returns "total" : 0.
  • The create request returns HTTP 409, ENTITY_ERROR, resultCode 7460: "You already have a current Developer ID Application Managed certificate or a pending certificate request."
  • The export then fails with No "Developer ID Application" signing certificate matching team ID "4G35KLFD64" with a private key was found.

A few data points that might help narrow this down:

  1. Timing. Build 11016 on Oct 15 still signed with the managed certificate (ID PXZ54PQ6QZ, serial 02D86889999D3EA2). That certificate was issued Aug 18, 2026 by the previous Developer ID Sub-CA and expires Feb 1, 2027. Nov 3, the first failing build, is exactly 90 days before that expiry, which is when the automatic rotation is documented to start. The certificates in the other reports here expire Feb 1–2, 2027 as well, so this looks like the automatic rotation to the G2 Sub-CA stalling, not a per-team misconfiguration.

  2. Portal vs. API. The managed certificate is still listed in Certificates, Identifiers & Profiles for our Account Holder, while the Xcode Cloud certificate API returns an empty list for the type. Admins on the team do not see it in their list at all.

  3. Manual rotation does not help. Our Account Holder clicked Rotate on the certificate; the dialog states manual rotation is available from six months after creation until 90 days before expiry, which this certificate is outside of. The next build failed identically.

  4. Revoking is not an option for us. The managed certificate has signed every build we shipped since August. Per the Developer ID support page, apps signed with a revoked Developer ID certificate can no longer launch. We would appreciate confirmation from DTS whether that applies to cloud-managed certificates as well, since the accepted answer in thread 853905 recommends revoking.

Error ID from build 11020, in case it helps whoever looks at the server side: 0ae275a5-d31e-4822-b2ac-8763c13e2162. A Developer Support case is being opened by our Account Holder.

DTS Engineer OP
Apple

D’oh! I posted the wrong URL. I’ve gone back and fixed that.

As should be clear by now, this is affecting a number of developers. We’re tracking it as FB25329877 [1].

You definitely don’t want to be revoking any Developer ID certificates. As explained on Account > Certificates > Certificates overview, that’s has a significant impact and it only makes sense if it was compromised. That’s why revocation is a manual operation for Developer ID [2].

As to what you should do right now, I don’t have good answer for you. I’m off to do more research and I’ll get back to you.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] This is a developer-filed bug. I don’t think it’s from anyone on this thread but, if I’m wrong and this is your bug, thanks for filing it.

[2] I suspect there’s a terminology mixup with the accepted answer on that other thread.