Skip to content
SeriesMobile app signing and push notifications

App Signing & Push

Certificates, keys, profiles and push notifications on iOS and Android, explained plainly and checked against Apple's and Google's own documentation.

44 parts10h totalSep 17, 2026 — Sep 17, 2026
Start part 1Read the overview →
  1. p8 vs p12: What Each Apple File Holds, and Which One to UseA .p8 is one private key with no password and no expiry. A .p12 is a certificate and its private key behind a password. What each holds, and which one to use.16 min
  2. Converting Signing Files: P12 to PEM, P8 to PEM, JKS to P12Tested openssl and keytool commands for .p12 to PEM and back, .p8 keys, DER certificates and JKS to .p12, plus why OpenSSL 3 needs -legacy and LibreSSL does not.13 min
  3. App Store Connect API Key: Issuer ID, Key ID and the .p8An App Store Connect API key is an Issuer ID, a Key ID and a .p8 you can download once. Team and individual keys, roles, tokens, and how CI tools take the three values.15 min
  4. Sign in with Apple on Android and the Web: Services ID and Private KeySign in with Apple on Android and the web needs a Services ID, return URLs and a private key that signs a six-month client secret. Setup for Firebase, Supabase and your server.16 min
  5. APNs Explained: How Apple Push Notifications Reach a DeviceAPNs is Apple's push delivery service. How the HTTP/2 request works, every header, the aps payload, token vs certificate auth, and what each APNs status code means.15 min
  6. APNs Auth Key (.p8): Create It and Add It to FirebaseCreate an APNs auth key (.p8) in Apple's portal, choose team-scoped or topic-specific, upload it to Firebase with its Key ID and Team ID, and rotate it without downtime.13 min
  7. APNs Certificate Expired? Renew It, or Move to a .p8 KeyAn expired APNs certificate silently stops iOS push. Check its expiry, renew it with a new CSR and .p12, or move to a .p8 key that never expires. Step by step.12 min
  8. How Push Notifications Work on Android and iPhone: FCM and APNs ExplainedA push notification goes from the app's server to Firebase Cloud Messaging, then through Google Play services on Android or Apple's APNs on iPhone. Each step, with diagrams.17 min
  9. VoIP Push on iOS: VoIP Services Certificate or APNs KeyVoIP pushes wake an iOS calling app through PushKit, which must report the call to CallKit. Send them with a VoIP Services certificate or an APNs key and a .voip topic.12 min
  10. Every Certificate in Apple's Developer Portal, ExplainedApple's portal lists twenty certificate types in two groups. What each one does, which two an iOS or Flutter app needs, and what the intermediate certificates are for.15 min
  11. Apple Development vs Apple Distribution CertificatesApple Development certificates are personal and run builds on your own devices. Apple Distribution certificates belong to the team and ship to TestFlight and the App Store.13 min
  12. How to Create a Certificate Signing Request on a MacCreate a certificate signing request in Keychain Access, step by step: what to type in each field, where the private key goes, and an OpenSSL route for Linux and Windows.12 min
  13. Export a .p12 From Keychain and Use It on Another Mac or in CIExport a certificate and its private key as a .p12 from Keychain Access, import it on another Mac, and install it on a GitHub Actions runner with a temporary keychain.13 min
  14. Missing Private Key in Xcode: Why It Happens and the FixXcode says Missing Private Key when your Mac has the certificate but not the key made with it. How to confirm it, the three fixes, and what revoking really costs.14 min
  15. Apple Certificate "Is Not Trusted": The WWDR Intermediate FixKeychain Access marks an Apple certificate not trusted when the WWDR or Developer ID intermediate that issued it is missing. Which one you need, how to add it, other causes.11 min
  16. When an Apple Certificate Expires or Is Revoked: What BreaksAn expired or revoked Apple certificate doesn't touch App Store apps, but it can stop Ad Hoc, in-house and Mac builds. What breaks for each type, and how to replace one safely.12 min
  17. Developer ID Certificates: Shipping a Mac App Outside the App StoreDeveloper ID certificates sign Mac apps shipped outside the App Store. Who can create them, the five-per-kind limit, notarizing and stapling, revocation, and the 2027 G1 expiry.14 min
  18. Bundle ID vs App ID: The Name in Your App and Apple's Record of ItA bundle ID is the name inside your app. An App ID is Apple's record of it: Team ID plus capabilities. Explicit vs wildcard, extensions, and Android's applicationId.13 min
  19. Can You Change a Bundle ID? What Apple Allows, and Doing It in FlutterA bundle ID can change until the first build reaches App Store Connect; after that, a new ID means a new app. What that involves, and the exact Flutter steps.11 min
  20. Every Identifier in Apple's Developer Portal, ExplainedThe eleven identifier types in Apple's developer portal, from App IDs and App Groups to Merchant, Media and Maps IDs: what each one names and when you need it.14 min
  21. Provisioning Profiles Explained: What's Inside and Why Builds FailA provisioning profile is Apple's signed permission for a build: who signs, which app, which devices, until when, with which powers. How to read one and fix failures.13 min
  22. iOS Entitlements: What Your App Claims and the Profile GrantsAn entitlement is a key sealed into your app's signature that claims a power such as push. The app claims it, the profile grants it, the App ID allows it. How to check.13 min
  23. Ad Hoc Distribution on iOS, and When TestFlight Is BetterAd Hoc puts an iOS test build on registered devices without TestFlight: device IDs, the Ad Hoc profile, exporting, installing, and when TestFlight fits better.15 min
  24. App Groups on iOS: Sharing Data With Widgets and ExtensionsAn App Group lets your iOS app and its widgets or extensions share settings and files. Register the group ID, add the capability to every target, and read it in Swift.12 min
  25. Pass Type ID Certificate: Signing Apple Wallet PassesA Pass Type ID names one kind of Apple Wallet pass, and its certificate signs every pass and sends update pushes. Setup, pass.json, signing, updates and expiry.13 min
  26. Apple Pay Merchant ID and Its Two CertificatesAn Apple Pay Merchant ID never expires; its Payment Processing and Merchant Identity certificates last 25 months. What each does, setup, Stripe, web domains, renewal.14 min
  27. fastlane match: One Set of iOS Certificates for the Whole Teamfastlane match keeps one encrypted set of iOS certificates and profiles for the whole team. Storage options, match types, API keys, readonly CI setup and nuke.14 min
  28. Flutter iOS Code Signing: From First Run to TestFlightFlutter iOS apps are signed by Xcode: pick a team on the Runner target to run on a device, then flutter build ipa and upload to App Store Connect for TestFlight.14 min
  29. Play App Signing: Upload Key vs App Signing KeyWith Play App Signing, Google keeps the key that signs what users install and you keep an upload key. How the two differ, setup, fingerprints and key upgrades.14 min
  30. Lost Your Upload Key? Resetting It in Play ConsoleLost your Android upload key or its password? With Play App Signing you create a new key, export a PEM certificate and request a reset. What happens while you wait.11 min
  31. What's Inside a .jks Keystore: Aliases, Passwords and FormatsA .jks keystore holds private keys and certificates under aliases, behind a store password and key passwords. JKS vs PKCS12, inspecting, converting, and the other Android Keystore.12 min
  32. Flutter Release Signing: Keystore, key.properties and GradleSign a Flutter Android release for Google Play: create an upload keystore, store its passwords in key.properties, and read them in build.gradle.kts. Plus checks and CI.11 min
  33. The Android Debug Keystore: Location, Password and AliasThe Android debug keystore lives in the .android folder, with password android and alias androiddebugkey. Where it is, why its SHA-1 changes, and how teams share it.12 min
  34. keytool Commands Android Developers Actually UseThe keytool commands Android developers use: create a key, list a keystore, print SHA-1 and SHA-256, export a certificate, convert JKS to PKCS12 and change passwords.13 min
  35. APK Signature Schemes v1, v2, v3 and v4Android's APK signature schemes v1, v2, v3, v3.1, v3.2 and v4: what each adds, which Android versions read them, what your minSdk needs, and how to check with apksigner.14 min
  36. Play's Quantum-Ready Hybrid Signing: What It Means for Your FingerprintsGoogle Play's quantum-ready hybrid signing pairs an RSA key with an ML-DSA key, plus a classical key for older phones. What it means, who is enrolled, which fingerprints to add.14 min
  37. Android Developer Verification: What Changes From 30 September 2026From 30 September 2026, some Android installs need a verified developer and a registered package name. Who is affected, what to register, and what users will see.15 min
  38. How to Get SHA-1 and SHA-256 Fingerprints for All Three Android KeysEvery way to get SHA-1 and SHA-256 fingerprints for an Android app's debug, upload and Play app signing keys, and where each one goes: Firebase, Google Cloud, assetlinks.13 min
  39. Google Sign-In Error 10: The Missing SHA-1Google Sign-In error 10 is DEVELOPER_ERROR: the app is misconfigured. The usual cause is a missing SHA-1, often Play's app signing key. The fix, and what else to check.12 min
  40. assetlinks.json: Setting Up Android App Links, and Why They Failassetlinks.json tells Android which apps may open your web links. The file format, hosting rules, autoVerify, testing tools, and the Play app signing fingerprint trap.13 min
  41. Where Is the FCM Server Key? Sending Push With the HTTP v1 APIThe FCM server key is gone with the legacy API. Send with HTTP v1 using a service account and OAuth access token, with tested Node code and a legacy-to-v1 field map.12 min
  42. google-services.json and GoogleService-Info.plist: What They Hold, and Are They Secret?What google-services.json and GoogleService-Info.plist contain, where they go in Android, iOS and Flutter, why they are not secret, and what a new SHA-1 changes.14 min
  43. "App Not Installed as Package Conflicts With an Existing Package": What It MeansAndroid shows this when an app with the same internal name is already installed and the two copies were signed with different keys. What it means and how to fix it safely.10 min
  44. "Untrusted Enterprise Developer" on iPhone: What It Means and When to Trust ItThe iPhone shows this for apps an organisation handed out outside the App Store. Where to trust the developer on current iOS, when that is safe, and why some apps stop opening.9 min