When uploading to the App Store, ITMS-90035 is a typical signing error. Many people first assume the IPA is corrupted, but in reality, this error is more related to certificates, provisioning profiles, signing methods, and export methods.

Especially in scenarios like Flutter, uni-app, React Native, HBuilderX, and Jenkins automated builds, this error is more likely to occur.

What is ITMS-90035

The error message typically looks like ERROR ITMS-90035: Invalid Signature or This bundle is invalid.

Apple indicates that the uploaded IPA failed signature verification.

Where Does the Error Occur

First, distinguish:

Stage Belongs to ITMS-90035?
Xcode Archive failed No
IPA installation failed Not necessarily
Rejected by Apple after upload Yes
Processing failed Very likely

Most Common Issue: Certificate Type Mismatch

This is the most frequent situation in real projects.

For example, using a Development certificate while the upload target is App Store. In this case, the IPA can be generated and may install on a device, but the upload fails.

The correct approach is that uploading to the App Store requires:

Type Purpose
iOS Distribution App Store distribution
App Store Profile App Store upload

Another frequent issue: provisioning profile and certificate mismatch, for example:

Item Actual Type
Certificate Distribution
Profile Development

Or the reverse.

How to Check the Provisioning Profile

Open the .mobileprovision file and focus on:

Field Content
Name Profile name
TeamIdentifier Team
Entitlements Permissions
ProvisionedDevices Whether it’s a test version
ProvisionsAllDevices Enterprise version

Check If Bundle ID Is Consistent

An easily overlooked issue: the App ID in the profile does not match the actual Bundle ID used for packaging. For example, profile: com.demo.app, but actual: com.demo.test. Apple will directly deem the signature invalid during upload.

Typical Issues in uni-app Scenarios

In HBuilderX cloud packaging, it’s common to see the app identifier in the profile file not matching the package name. The reason is that manifest.json, Bundle ID, and mobileprovision are inconsistent.

Regenerating Certificates

The more time-saving approach to these issues is to regenerate the entire signing chain, including the Bundle ID, certificate, and provisioning profile.

To regenerate in the Windows environment, you can directly use AppUploader, which allows you to manage Bundle IDs, create Distribution certificates, generate App Store provisioning profiles, and upload IPAs in Windows, without relying on Xcode or Keychain.

Step 1: Confirm the Bundle ID

For example, com.company.app, ensure the Apple developer portal, packaging configuration, and Profile are all consistent.

Step 2: Recreate the Distribution Certificate

Do not continue using the old Development certificate.

Step 3: Recreate the App Store Profile

Be careful not to select the Development type.

Step 4: Re-export the IPA

If using Xcode Export → App Store Connect, do not choose Ad Hoc.

Issues in Jenkins / Fastlane Scenarios

In CI environments, it’s common to have the certificate present but the private key missing. This manifests as successful uploads locally but failures in Jenkins, due to an incomplete P12.

So you need to verify whether the IPA is actually signed correctly.

Unzip the IPA with the command: unzip app.ipa, then check Payload/App.app to see if _CodeSignature and embedded.mobileprovision exist.

Issues Caused by Upload Tools

Recently, Apple has been stricter about legacy upload protocols. If you see Deprecated Transporter usage, it means the upload tool is outdated or the Transporter protocol has been deprecated.

In this case, upgrade the upload tool or use a new upload channel.

CLI Upload Makes Log Diagnosis Easier

Many errors are hidden in GUI uploads, while CLI makes it easier to see complete logs for metadata, transporter, signing, and upload session. For example:

appuploader_cli upload \
-f app.ipa \
-u user@example.com \
-p xxxx-xxxx-xxxx-xxxx \
--type ios

Finally, the issues can be summarized as:

Type Frequency
Incorrect certificate type Very high
Incorrect Profile type Very high
Bundle ID mismatch Very high
Missing private key Medium
Outdated upload protocol Medium
Corrupted IPA Low

ITMS-90035 essentially means Apple is verifying whether the IPA has a legitimate and complete signature. Therefore, the troubleshooting focus is not on the “upload button” but on whether the certificate, provisioning profile, Bundle ID, and export method are consistent.