How to Handle “Validation failed (409) Missing or invalid signature” (ITMS-90034) in Xcode

When uploading an iOS app from Xcode Organizer, App Store Connect may reject an archive with ITMS-90034 even though Xcode appears to have used an Apple Distribution certificate. The usual causes are a certificate, private-key, provisioning-profile, team, or nested-code mismatch. However, a September 2026 Apple Developer Forums report describes a newly enrolled Individual account where the same locally verified IPA failed through both Xcode and Transporter. Apple DTS advised the developer to file a bug with the IPA, signature analysis, and Transporter logs, and to contact App Store Connect support. This guide separates issues you can correct locally from cases that require account-side or server-side investigation.

Representative error

Validation failed (409)
Missing or invalid signature.
The bundle at "Payload/[App].app" is not signed using an Apple submission certificate.
(ID: 90034)

The same diagnostic can appear as ITMS-90034 when the exact IPA exported by Xcode is submitted with Transporter.

Possible causes

• The distribution archive was signed with Apple Development, Ad Hoc, Developer ID, or another identity instead of Apple Distribution.
• The certificate’s private key is missing, expired, revoked, or its trust chain cannot be validated.
• The app’s Team ID, Bundle ID, and App Store provisioning profile do not match.
• An app extension, framework, or plug-in is signed by a different team or identity.
• The archive was modified or incorrectly re-signed after Xcode created it.
• Local signing is valid, but App Store Connect may not be validating a newly enrolled account or team correctly.

Affected conditions and versions

The September 2026 forum case involved the first iOS upload from a newly enrolled Individual Apple Developer Program account. The developer verified the Apple Distribution certificate and private key, the Team ID and Bundle ID, the App Store profile, and Xcode’s export summary. Nevertheless, both Xcode Organizer and Transporter rejected the same IPA.

Apple has not published a specific affected Xcode range or a version containing a confirmed fix. Updating Xcode is reasonable, but it cannot currently be presented as a guaranteed solution.

Recommended troubleshooting

1. Verify membership, team, and identifiers

Confirm that the Apple Developer Program membership is active. In the app target’s Signing & Capabilities settings, the selected Team must own the App Store Connect app record, and the Bundle Identifier must exactly match the registered App ID.

2. Verify the Apple Distribution identity and private key

security find-identity -v -p codesigning

Look for Apple Distribution: Team Name (TEAMID). In Keychain Access, expand the certificate and confirm that its private key is present. Avoid revoking certificates casually: revocation can break distribution on CI and other team Macs.

3. Clean up Xcode’s distribution configuration

1. Enable Automatically manage signing for the application target.
2. Check Release settings for stale manual values in Code Signing Identity, Development Team, and Provisioning Profile.
3. Inspect every extension target and use the same intended team.
4. Increment the build number and create a completely new archive.

4. Export and inspect the exact IPA

Export an IPA using Xcode Organizer’s App Store Connect distribution workflow, then inspect that exact file:

mkdir ipa-check
cd ipa-check
unzip ../MyApp.ipa

codesign --verify --deep --strict --verbose=4 "Payload/MyApp.app"
codesign -dvvv "Payload/MyApp.app" 2>&1   | egrep "Identifier|Authority|TeamIdentifier"

The output should show the expected Bundle ID, Authority=Apple Distribution: ..., and the correct TeamIdentifier. Verification should also report that the bundle is valid on disk and satisfies its designated requirement.

5. Inspect nested code separately

A valid main app does not prove that every framework or extension is correctly signed. List and inspect the embedded code:

find "Payload/MyApp.app" \( -name "*.framework" -o -name "*.appex" \) -print

codesign -dvvv "Payload/MyApp.app/Frameworks/Example.framework" 2>&1   | egrep "Authority|TeamIdentifier"

Do not use a blanket codesign --deep --force operation as a shortcut. It can produce an invalid nested signing structure. Correct the target or dependency build process and archive again.

6. Inspect the provisioning profile and entitlements

security cms -D   -i "Payload/MyApp.app/embedded.mobileprovision"   > profile.plist

codesign -d --entitlements :- "Payload/MyApp.app"

Check that the profile’s Team Identifier and Application Identifier match the app, and that its entitlements are suitable for App Store distribution. For an App Store build, get-task-allow is normally false.

7. Submit the same IPA through Transporter

Use Transporter to upload the exact IPA you just inspected. If only Organizer fails, investigate Xcode’s account session or export path. If both Xcode and Transporter return the same 90034 for the same verified IPA, the issue is less likely to be limited to the local Xcode UI.

8. Escalate with evidence when local verification passes

Apple DTS recommends filing a report through Feedback Assistant and contacting the App Store Connect team. Include:

• The exact IPA that failed.
• Your codesign analysis.
• Transporter delivery logs.
• Team ID, Bundle ID, failure time, and Xcode/macOS versions.
• A note that both Xcode and Transporter reproduce the error.

Alternatives

Try a new archive created with automatic signing or Xcode-managed distribution credentials. If the verified IPA still fails through multiple official upload paths, repeatedly revoking and recreating certificates is not guaranteed to help. Teams with CI can archive the same commit in a second known-good signing environment to determine whether the failure follows one Mac or the developer team.

How to verify the resolution

• security find-identity lists a valid Apple Distribution identity.
• The main app and all nested code use the intended Authority and TeamIdentifier.
• codesign --verify --deep --strict succeeds.
• The embedded profile matches the app’s App ID and team.
• A freshly created archive passes Validate App.
• After upload, the build appears as processing or available in App Store Connect.

Cautions

Summary

For Validation failed (409) Missing or invalid signature (ITMS-90034), first verify the Apple Distribution certificate, private key, team, Bundle ID, profile, nested code, and the exact exported IPA. Create a fresh archive after correcting any mismatch. If the same locally verified IPA fails in both Xcode and Transporter, preserve the IPA, signature output, and delivery logs, then submit them through Feedback Assistant and App Store Connect support. Evidence-based separation is essential; passing one local check alone does not prove the problem is server-side.

Official references

• Apple Developer Forums: Persistent ITMS-90034 on new Individual account
• Distributing your app for beta testing and releases
• Certificates overview
• Code Signing Guide: Using codesign to investigate a signature
• Technical Q&A QA1798: Checking Distribution Entitlements
• WWDR intermediate certificates