How to Import a Certificate in Scarlet (Step by Step)
Scarlet works out of the box with its built-in shared certificate, but that certificate is also its weakest point: when Apple revokes it, every app installed with it stops opening at once. Importing your own certificate into Scarlet is how you escape that cycle. This guide explains what a Scarlet certificate actually is, where people legitimately get one, and the exact steps to import a .p12 certificate and its provisioning profile into Scarlet — plus the fixes for the errors that stop most imports.
What a “Scarlet Certificate” Actually Is
A certificate for Scarlet is not a single file. It is a matched pair:
- The .p12 file — the signing certificate itself, bundled with its private key and protected by a password. This is the part that actually signs apps.
- The .mobileprovision file — the provisioning profile. It ties the certificate to a list of registered device UDIDs and a set of entitlements, and it carries an expiry date.
- The password — set when the .p12 was exported. Without it, Scarlet cannot open the certificate at all.
All three pieces must belong together. A .p12 from one source and a provisioning profile from another will not work, because the profile names the specific certificate it was issued for. If you want background on how certificates behave once installed — revoked, expired, working — our Scarlet certificate status hub tracks the patterns we see.
Where Do People Get a Certificate?
There are three legitimate routes, and they differ a lot in reliability:
| Route | What you get | Realistic lifespan |
|---|---|---|
| Your own Apple Developer account | A certificate you create yourself in Apple’s developer portal, with your devices registered by UDID | Up to a year, and only you can revoke it — the most stable option by far |
| A paid signing service | A certificate issued from the service’s developer account, usually delivered as a .p12 + .mobileprovision pair | Months if the service is careful; can end early if the service abuses its account |
| Free “leaked” or shared certificates | Somebody else’s certificate, shared publicly | Days at best. Thousands of devices use them, Apple notices, and they are revoked quickly |
We will be blunt: free public certificates are a treadmill. They are fine for testing whether the import process works, but building your setup on one means reinstalling everything when it dies — often within the week. A certificate from your own developer account is the only option where you control the outcome. Our older walkthrough of the custom certificate method covers that route from the Scarlet side as well.
Before You Import: The Checklist
- Both files (.p12 and .mobileprovision) saved somewhere your iPhone can reach — the Files app works fine.
- The certificate password, written down exactly. Passwords are case-sensitive.
- Your device’s UDID registered in the provisioning profile. If it is not, the import may appear to succeed but every app you sign will fail to install or open.
- Scarlet itself currently opening. If Scarlet is already revoked, fix that first — you cannot import a certificate into an app that will not launch.
How to Import a Certificate in Scarlet: Step by Step
- Open Scarlet and tap the Settings (gear) tab.
- Scroll to the Signing / certificate section and choose Import Certificate (wording varies slightly between versions).
- Select the .p12 file from Files when prompted.
- Enter the certificate password exactly as provided. Take your time — this is the step most people rush and get wrong.
- Select the .mobileprovision file when Scarlet asks for the provisioning profile.
- Wait for the confirmation. Scarlet verifies the pair and, if they match, the imported certificate becomes your active signing certificate.
- Test it: sign and install one small IPA. If it installs and opens, the import is genuinely working — that test matters more than any success message.
From this point, apps you install through Scarlet are signed with your certificate rather than the shared one. Apps you installed earlier with the old certificate are not converted — they stay tied to the certificate that signed them, so reinstall the ones you care about.
Import Errors and What They Mean
| Error or symptom | Likely cause | Fix |
|---|---|---|
| “Invalid password” or import fails immediately | Wrong .p12 password, or the password was changed when the file was re-exported | Ask the source for the exact password; retype it manually instead of pasting, which can carry hidden characters |
| Certificate imports but apps won’t install | Your UDID is not in the provisioning profile | Get your UDID added and a fresh .mobileprovision issued — no setting on the phone can fix this |
| Apps install, then stop opening within days | The certificate was revoked by Apple | No fix for that certificate. Replace it, and read our Scarlet anti-revoke guide to slow down the next one |
| “Certificate and profile do not match” | The two files come from different certificate pairs | Re-download both files from the same source as one package |
| Apps open but some features are missing | The profile lacks the entitlements those features need (common with notifications and some extensions) | Only the certificate issuer can broaden the profile’s entitlements; a limited profile is a known trade-off of cheap signing services |
How Long Will an Imported Certificate Last?
Honestly: it depends entirely on whose certificate it is. A certificate from your own developer account normally lasts until its expiry date, up to a year. A signing service’s certificate lasts until the service misbehaves, oversells it, or Apple catches the pattern. A public certificate lasts until the next revoke wave, which can be days. No certificate — from anyone — is permanent, and anyone selling you one as “lifetime” or “never revoked” is not telling you the truth. Build your setup so a revoke is an annoyance (re-import, re-sign) rather than a disaster, and the arrangement works well enough.
FAQ
Can I import a certificate into Scarlet for free?
Yes — if you have a certificate to import. Free certificates circulate in sideloading communities, and Scarlet’s import feature itself is free. The catch is lifespan: public certificates are shared by thousands of devices and are revoked fast, so treat them as a way to learn the process, not a permanent setup.
What is the difference between the .p12 file and the .mobileprovision file?
The .p12 is the signing certificate with its private key — it does the actual signing. The .mobileprovision is the profile that authorises which devices and entitlements that certificate may be used with. Scarlet needs both, and they must be a matched pair.
Do I lose my apps when I switch certificates in Scarlet?
Apps signed with the old certificate keep working only while that certificate stays valid — they do not transfer to the new one. After importing a new certificate, reinstall the apps you still use so they are signed with it.
Why does Scarlet ask for a password when importing?
Because .p12 files are encrypted with a password when they are created. Scarlet needs that password to open the certificate and sign with it. If the source of your certificate did not give you a password, ask them — there is no way around it.
Is using my own developer account with Scarlet worth it?
For most regular sideloaders, yes. It costs the standard Apple Developer Program fee, but it is the only route where revokes are essentially in your control, certificates last up to a year, and your UDID is registered by definition. The break-even against repeatedly paying for signing services arrives quickly.
