Scarlet Anti-Revoke Explained: How It Works and How to Stop Apps Getting Revoked

Every Scarlet user eventually meets the same morning: apps that worked yesterday refuse to open today. The certificate was revoked. “Scarlet anti-revoke” is the umbrella term for every technique that tries to prevent that moment — and the internet oversells all of them. This guide explains honestly what Scarlet anti revoke can and cannot do, how each method works, and the setup that actually gives you the fewest dead-app mornings.

First: What “Revoked” Actually Means

Scarlet and the apps it installs run on signing certificates. iOS does not simply trust a certificate once and forget it — when a certificate-signed app launches, iOS can check that certificate’s current status with Apple. If Apple has revoked the certificate (which it does to shared enterprise certificates used for mass sideloading), the check comes back negative and iOS refuses to open every app signed with it. This is why revocations hit everyone using the same certificate at the same moment, and why no setting inside Scarlet can “un-revoke” anything. Apple explains the trust model for manually installed apps on Apple Support, and our certificate status hub covers what to do when it happens to you.

How Scarlet Anti-Revoke Methods Work

Method 1: DNS anti-revoke (block the status check)

The most popular approach. If iOS cannot reach Apple’s certificate-status servers, it cannot learn that a certificate was revoked — so a DNS profile that blocks those specific Apple domains can keep already-installed apps opening after a revocation. This is the principle behind the method in our DNS AntiCert sideloading guide. Understand what it really is: it hides the revocation from your phone. It does not restore the certificate, it must be installed before the apps die to help, and iOS can still fail apps for other reasons (expired profiles, local validity checks).

Method 2: Your own certificate (nothing shared to revoke)

The only method that removes the root cause. Revoke waves target shared certificates. A certificate that belongs only to you is not part of those waves; your apps keep working until your own certificate naturally expires. You can import your own certificate into Scarlet using the custom certificate method, or use it with a signer like ESign. This is the setup serious sideloaders end up with.

Method 3: Airplane-mode tricks (mostly myth)

Opening apps in airplane mode sometimes works once, because the status check cannot complete. It is unreliable, breaks any app needing the internet, and fails permanently once the check succeeds a single time. Treat it as a way to grab data out of a dying app, not a strategy.

The Honest Limits of Anti-Revoke

• No method makes a shared public certificate permanent. Anyone claiming a “no revoke forever” setup on a public certificate is selling you something.
• DNS profiles see your traffic. A DNS anti-revoke profile routes all your domain lookups through someone else’s filter. Only use profiles from sources you genuinely trust — a malicious DNS profile is a real privacy risk, far worse than a revoked app.
• iOS updates change the game. Apple adjusts verification behavior over time; a DNS list that works today may leak the status domains after an update. Keep the profile updated or accept it as temporary protection.
• Prevention is not recovery. Once an app has failed its status check with revocation, anti revoke cannot revive it — the fix is reinstalling under a working certificate via the order in our Scarlet not working guide.

The Setup That Minimizes Revokes (Checklist)

1. Install the DNS anti revoke protection while everything still works — it cannot be applied retroactively.
2. Keep Scarlet itself updated using the steps in how to update Scarlet.
3. For apps you cannot afford to lose, sign them with your own certificate instead of the shared one.
4. Keep a fallback installer ready from our Scarlet alternatives list for the days a revoke does land.
5. Back up important app data regularly — revocation does not delete data, but reinstalling sometimes can.

FAQ

Does anti-revoke really work?

The DNS method genuinely works as a preventive measure for many users, because it blocks the online status check. It is partial protection, not immunity, and it cannot fix apps that have already failed.

Is anti-revoke safe?

The concept is safe; the source is the risk. A DNS profile from an untrusted source can monitor or redirect your browsing lookups. Only install profiles you can verify, and remove them when you stop needing them.

What is the most reliable way to avoid revokes?

Your own certificate. Shared certificates get revoked in waves that no trick fully escapes; a private certificate is outside those waves entirely.

My apps already stopped opening. Can anti-revoke fix them?

No. Once iOS has recorded the revocation, the apps must be reinstalled under a valid certificate. Scarlet anti revoke is for preventing the next one.