Apple Enterprise app signing

Question

How long the enterprise-signed ipa can be install on iOS devices? A company which have enterprise developer account signed my app and charge me an amount. They said that this app can be installed on devices forever. Is this true or the app has a limited time for installing?

Answer 1

Assuming you are talking about the Enterprise In-House Distribution type, you have at most 1-3 years. See details below, but with no other intervention, users will lose access to the app when the profile expires (at most 1 year).

The certificate used to sign an enterprise app will be valid for 3 years from time of creation. However, the provisioning profile that also is used to sign the app will be valid only for 1 year from when it is created.

If you take an app that is built and signed with a profile /cert both created on the day they sent it to you, you can run the app, as-is, on your device for 1 year. Then the provisioning profile will expire, and if you have not somehow gotten a new provisioning profile on the device, the app will not launch.

There are multiple ways you can get a new provisioning profile on an iOS device without having to rebuild the app. First, you can use an MDM prpduct to push a the new profile to the device. Or, you could get another app, signed with the same certificate, but a newer provisioning profile, installed on the device. As long as the profile is using a wildcard app ID, this will allow you to continue to run the app. Note, however, that the original developer would need to provide you with either the new profile or another app signed with the new profile.

If you manage to renew your provisioning profile on the device to keep it running for 3 years, when the certificate expires, the only way to run the app will be to get a new application binary that has been signed with a new profile and certificate. An expired certificate invalidates the binary and there will no way to ruin the app on the device without installing a new version that has been re-signed with a new cert / profile. This also requires the original developer to provide you with the new signing identity files, or rebuild the app for you.

If you truly want to have the app build you an app that will run "forever" without signing problems, you should have them distribute the app through the App Store privately using Apple's B2B program: https://developer.apple.com/programs/volume/b2b/

Those apps will technically run on a device indefinitely, assuming you don't always update new versions of the OS / hardware. Note that when Apple releases major iOS updates, many apps will have problems where the apps will behave differently on iOS11 vs. iOS 10. It is very unlikely that an app released in one year will still function properly 3 years later without some changes. And they most certainly won't take advantage of new hardware / software features (like the iPhone X's taller screen). Mobile app development is an ongoing cost / effort.

Answer 2

Actually, it is some kind of forever. Since every time users open the app, it will check the signed file. While the company‘s enterprise developer account is valid, your app can be installed. If the sign certificate revoked by the Apple, your app can't be installed anymore.

Answer 3

No, the p12 description file generated by a certificate can only be used for one year. When it expires, it must be regenerated and the app is signed again.enter image description here