How to Sign an iOS App (IPA) on Windows — Without a Mac

Short answer: you can get a fully signed iOS IPA from a Windows PC with no Mac involved. Generate your Apple signing certificate with OpenSSL and the Apple Developer web portal (both work fine on Windows), then either sign locally with an open-source tool like zsign — workable but fragile — or upload your certificate to a cloud signing service that runs the actual signing on Apple silicon. The second path is the one that behaves the same way every time.

Why signing is the part that actually demands a Mac

Building an iOS app and signing an iOS app are two different problems, and it's worth being precise about which one is blocking you. Compilation needs Xcode, which needs macOS — but that's a solved problem: cloud build services (ours included) run the compile step on real Apple hardware, and we've covered the options in our guide to building iOS apps without a Mac.

Signing is stickier. Apple's codesigntool is a macOS binary with no official Windows or Linux port, and the conventional workflow assumes the macOS Keychain: you generate a certificate request in Keychain Access, the private key lives in the Keychain, and Xcode quietly wires certificates to provisioning profiles behind the scenes. Take macOS out of the picture and all of that scaffolding disappears — which is why so many Windows developers end up with a compiled IPA they can't do anything with.

The good news: nothing in Apple's signing formatactually requires a Mac. A signature is cryptography plus a specific bundle layout, and both can be produced elsewhere. What requires care is doing it in a way Apple's devices and App Store validation will accept.

The three artifacts every signed IPA needs

Regardless of what does the signing — a Mac, a Windows tool, or a cloud service — the inputs are always the same three things:

• An Apple Developer Program membership — $99/year, under your own account. Your Bundle ID and certificates belong to you forever.
• A distribution certificate — your cryptographic identity, exported as a password-protected .p12 file containing the certificate and its private key.
• A provisioning profile — a .mobileprovision file that ties your certificate to your app's Bundle ID (and, for ad-hoc testing, to specific device UDIDs).

Every one of these can be created from a browser and a Windows command prompt. Here's the exact flow.

Step 1: Create your Apple certificate on Windows with OpenSSL

The Apple Developer portal doesn't care where your certificate signing request (CSR) comes from — Keychain Access is just the tool Apple documents. OpenSSL produces an identical CSR, and it ships with Git for Windows (look in C:\Program Files\Git\usr\bin) or installs in a minute on its own.

Sign in at developer.apple.com, go to Certificates, Identifiers & Profiles → Certificates → +, choose Apple Distribution, and upload distribution.csr. Apple hands back a .cerfile. While you're in the portal, register your Bundle ID under Identifiers and create a distribution provisioning profile under Profiles that links the two — download the resulting .mobileprovision file too.

One real-world snag worth knowing: OpenSSL 3.x defaults to modern PKCS#12 encryption that some older signing tools refuse to read. If whatever consumes your .p12 rejects it, re-run the export with the -legacy flag. And back up distribution.key somewhere safe — Apple never sees your private key, so nobody can recover it for you.

That's the whole certificate story. No Mac, no Keychain, roughly ten minutes. You now hold the same .p12 + profile pair a Mac user would have.

Step 2, option A: sign on Windows itself — an honest assessment

Open-source tools can apply the signature directly on Windows. The best of them is zsign, a cross-platform reimplementation of Apple's codesign that runs on Windows, Linux, and macOS. A typical invocation looks like:

It genuinely works — we've used it. But we'd be doing you a disservice if we left it there, because the failure modes are the kind you discover late:

• Entitlement mismatches surface after signing, not during. If the entitlements baked into the binary don't match the provisioning profile (push notifications and associated domains are the classic offenders), the IPA signs cleanly and then either fails to install or gets bounced at App Store validation.
• You can't smoke-test an App Store-signed IPA. An IPA signed with an App Store distribution profile will not install directly on your own iPhone — that's by design. Verifying it means an ad-hoc profile with your device's UDID (a second signing pass) or pushing through to TestFlight blind.
• The Windows device-communication stack is brittle. Tools like Sideloadly that install to a connected iPhone depend on Apple's desktop iTunes/iCloud libraries — and the Microsoft Store versions are sandboxed in a way that breaks them. The documented fix is uninstalling Store iTunes and iCloud entirely and reinstalling Apple's legacy desktop installers.
• No safety net. When macOS signing fails, Xcode usually tells you why. When zsign output misbehaves, you get a gray icon on a home screen and a debugging session across three forums.

Our honest take: local Windows signing is fine for tinkering and one-off internal installs. For an app you intend to ship — where a bad signature costs you an App Store review cycle — it's the wrong place to economize.

Step 2, option B: cloud signing on real Apple silicon

This is the path we built for exactly this situation. On the Pro plan and above, you upload the .p12you just created into an encrypted vault (AES-256-GCM at rest), and our Apple-silicon build machines use it to sign your IPA with Apple's own toolchain — you download a signed, submission-ready file. We never ask for your Apple ID or App Store Connect access, the certificate is used only for your builds, and you can delete it from the vault at any time. The full flow, including the default unsigned-IPA option for people who'd rather keep signing entirely on their side, is documented in the iOS setup guide, and the build infrastructure itself is described in our cloud signing deep-dive.

The practical difference from option A isn't the cryptography — it's that signing happens with Apple's real tools on Apple's real platform, so the entitlement and bundle-layout edge cases that trip up reimplementations simply don't apply.

Step 3: Getting the signed IPA into App Store Connect from Windows

Here's the part most guides skip, because it's where the last genuine Mac friction lives. Apple's Transporter — the drag-and-drop upload app — is macOS-only. As of mid-2026 there is still no Transporter for Windows. But you have two real no-Mac routes:

Either way, once the build lands in App Store Connect, everything that follows — screenshots, metadata, TestFlight, submitting for review — happens in the browser and works identically on Windows.

The zero-signing fallback: Web Clips

If what you actually need is “my site on an iPhone home screen, full-screen, this afternoon” — you can skip every certificate in this post. An iOS Web Clip is a configuration profile that installs your site as a home-screen app: no certificate, no $99 membership, no App Store review. It won't get you into the App Store and it isn't a native binary, but for internal tools, client previews, and validating demand before paying Apple, it's the fastest legitimate route that exists. We build these too — details in the iOS docs.

What this workflow doesn't do (read before you commit)

• We don't submit to the App Store for you. You upload the build and click Submit under your own Apple account. A managed-submission service is planned but not live — if you want it prioritized, tell support.
• The upload step is the least polished part. iTMSTransporter and the App Store Connect API both work from Windows, but neither is drag-and-drop. Budget an hour for first-time setup.
• Cloud iOS IPA builds and cloud signing require the Pro plan ($99/mo). Android builds and Web Clips are available from the first free build.
• React Native, Ionic, and Expo source projects are currently waitlist-only on our pipeline — this post's signing flow applies to website-wrapper IPA builds today.
• Apple's $99/year is unavoidable for anything App Store-bound. No tool on any OS gets around it.

The three signing routes at a glance

FAQ

Can I sign an IPA on Windows with only free tools?

Technically yes: OpenSSL for the certificate, the Apple Developer portal for the profile, and zsign for the signature — all free beyond Apple's $99/year membership. It's a legitimate path for testing and internal distribution. For App Store submissions, expect to debug entitlement and profile mismatches yourself, with the errors arriving at upload or review time rather than at signing time.

Do I have to give Code2Native my Apple ID or App Store Connect access?

No, and you shouldn't give it to anyone. Cloud signing uses only the .p12certificate you upload to the encrypted vault — never your Apple ID, password, or App Store Connect account. The default flow doesn't even need the certificate: we hand you an unsigned IPA and signing stays entirely on your side.

How do I get a .p12 certificate without a Mac?

Generate a private key and CSR with OpenSSL on Windows, upload the CSR in the Apple Developer portal to create an Apple Distribution certificate, download the .cer, then use OpenSSL to convert it to PEM and export a password-protected .p12 bundling the certificate with your key. The exact commands are in Step 1 above — the whole process takes about ten minutes.

How do I upload the signed IPA to App Store Connect from Windows?

Apple's drag-and-drop Transporter app is macOS-only as of mid-2026, but two no-Mac routes exist: the iTMSTransporter command-line tool, which Apple supports on Windows 11 and Linux, and the App Store Connect API, which has supported direct build uploads since WWDC 2025. After upload, everything else happens in the App Store Connect website.

Can I test the signed app on my own iPhone first?

Not with an App Store distribution signature — Apple blocks direct installs of App Store-signed IPAs by design. Register your iPhone's UDID in the developer portal, create an ad-hoc provisioning profile, and sign a separate test build with it. Or sidestep signing entirely with a Web Clip while you iterate, and sign only when you're ready to submit.

What does the full no-Mac path cost end to end?

Apple's Developer Program is $99/year. On our side, your first build is free (one credit, watermarked) so you can validate the pipeline; cloud iOS IPA builds with cloud signing come with the Pro plan at $99/month. Compare that against the usual alternative — a used Mac plus the hours to learn Xcode's signing maze — and the math tends to settle itself quickly.