How does the certificate system work in iOS?

Certificates are used for cryptographic signing and verification of applications, provisioning profiles, and connections. Key components include: Apple Root Certificate, Intermediate Certificates, Developer Certificates, Distribution Certificates, and Provisioning Profiles.

Apple Root Certificate — the trusted root certification authority of Apple.

Intermediate Certificates — certificates that link the root certificate to the developer/distribution certificates.

Developer Certificate — identifies the developer for development and debugging purposes on registered devices.

Distribution Certificate — used to sign applications before distributing via the App Store, Enterprise Programs, or Ad Hoc.

Provisioning Profile — links the app ID, developer/distribution certificates, and registered devices (for Ad Hoc and development). It defines which Apple services the app can use (e.g., Push Notifications, Capabilities).

Process:

A certificate signing request (CSR) is created on the developer's machine.
The CSR is uploaded to the Apple Developer portal.
Apple issues a developer or distribution certificate.
The certificate is installed in the Keychain on the developer's machine.
A Provisioning Profile is created on the Apple Developer portal, linking the app ID, certificate, and devices. The profile is also downloaded and installed.
The app is signed using the certificate and Provisioning Profile during build.
During device installation or before publishing to the App Store, the signature and Provisioning Profile are verified by the iOS system.

Verification: The iOS system checks the trust chain of the certificate, from the app certificate to the Apple Root Certificate, and the validity of the Provisioning Profile. If something is incorrect, installation or app launch is blocked.

provisioning profile
  .mobileprovision // file
  includes:
    - App ID
    - Certificates (Developer/Distribution)
    - Device UDIDs (for Dev/Ad Hoc)
    - Entitlements (capabilities)

certificate
  .cer // file
  signed by Apple
  linked to private key in Keychain