Installation & OTA updates to app with expired certificates?

Expo Development Tools
1

:hourglass: Time Sensitive :hourglass_flowing_sand:

For the past two years I’ve managed an Enterprise In House distributed app where I let Expo handle all of the certificate tasks for me. I no longer have access to my client’s Apple Developer Portal and I accidentally cleared the saved credentials when I ran expo build:ios --clear-push-cert --release-channel v4.1.0 when I received the notification to switch from using a Push Notification Certificate to a Push Notification Key. To make matters worse, the certificates are expiring in the next 2 weeks and the app goes live in a few days :man_facepalming:t5:.

Questions:

  1. Are these certs used at build time, install time, and/or runtime. (Distribution Certificate, Push Notification Key, Provisioning Profile)
  2. If I let the certificates expire:
    • Can I still publish OTA updates (expo publish)?
    • Can iOS users still install the app I built last year which contains the expired certificates?

Eeek please help, the new app needs to be live in a few days!
Thanks!
~JR

Please run expo diagnostics and paste the log that’s printed out along with your question or issue!

Expo CLI 3.1.0 environment info:
System:
OS: macOS 10.15.2
Shell: 5.0.11 - /usr/local/bin/bash
Binaries:
Node: 8.11.1 - /usr/local/bin/node
Yarn: 1.17.3 - ~/.yarn/bin/yarn
npm: 6.13.6 - /usr/local/bin/npm
Watchman: 4.9.0 - /usr/local/bin/watchman
IDEs:
Android Studio: 2.3 AI-162.4069837
Xcode: 11.0/11A420a - /usr/bin/xcodebuild
npmPackages:
expo: ^35.0.0 => 35.0.1
react: 16.8.3 => 16.8.3
react-native: https://github.com/expo/react-native/archive/sdk-35.0.0.tar.gz => 0.59.8
react-navigation: ^3.11.1 => 3.13.0
npmGlobalPackages:
expo-cli: 3.11.7

2

Edit: My response does not apply to Enterprise apps. If an enterprise app’s distribution cert or provisioning profile are revoked on the Apple Developer portal (or it expires), the app will stop working.

Hi! All in all, you’re pretty safe. Although I’m not sure how easy it will be to deploy new binaries without access to the Apple Developer Portal, but that’s another issue

  1. Are these certs used at build time, install time, and/or runtime. (Distribution Certificate, Push Notification Key, Provisioning Profile)

Distribution cert and provisioning profile are used at build-time, so these can be revoked/expire and have no impact on your in-production apps. The APN key is used at runtime, so if this is revoked then your current users will stop receiving push notifications.

  1. If I let the certificates expire:
  • Can I still publish OTA updates ( expo publish )?
  • Can iOS users still install the app I built last year which contains the expired certificates?

Yep, you can still publish OTA updates to existing applications. The only time you’ll need to renew your certs is when you expo build:ios again (besides the push notification key, see above)
And yes, your currently-available app can still be installed even though it’s associated with the old certs.

1 Like
3

Awesome, thanks for the update @charliecruzan!
I just want to confirm that your answer still holds true for Enterprise Distributions where the users are downloading the app over https from my web server (and not from the Apple App Store).

4

Hi, for enterprise it’s not exactly correct
If you just removed distribution certificate or provisioning profile from expo servers it wont affect anything, but if it’s revoked on apple developer portal or it’s expired apps will stop working.

5

Yikes :scream:, thanks for the heads up, I’m glad I followed up!
Tonight I’m going to work with the Admin team that has access to the developer account, and we’ll get all of these certs recreated.

6

Sorry about that @allanleonardjr! I didn’t know there were differences in certificate management for enterprise apps, I’ve edited my response

7

No worries!
Thanks for all of the responses.

8

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.