iOS 'Unable to Verify App' Error: Real Fixes

That error means iOS can't reach Apple's certificate server to verify the developer. Usually it's a network block or expired certificate, not a broken app.

Quick answer: iOS can't complete the OCSP certificate check with Apple's servers — either your network is blocking it, the developer certificate expired, or the profile trust got reset and you need to re-trust it in Settings > General > VPN & Device Management.

What's actually happening here is simple once you strip away the scary wording. When you tap an app that wasn't installed from the App Store — a TestFlight build, an enterprise (in-house) app, or something sideloaded with a free Apple ID — iOS doesn't trust it on face value. It reaches out to Apple's OCSP responder to ask "is this signing certificate still valid?" If that request fails or comes back revoked, you get the "Unable to Verify App" dialog and the app refuses to launch. This started biting a lot of people on iOS 17.4 because Apple tightened the OCSP checks and dropped support for older signing certs, so apps that worked fine on 17.3 suddenly threw this error after the update.

Three real-world triggers I see constantly:

You're on a corporate Wi-Fi or a Pi-hole/mobile ad-blocker DNS setup that silently drops ocsp.apple.com.
The enterprise provisioning profile expired (they're only good for 12 months and must be renewed by the signing org).
You restored from a backup or updated iOS and the "Trust" toggle for the developer got wiped.

Step-by-step fix

Toggle the trust setting off and back on. Go to Settings > General > VPN & Device Management (on older iOS it's called "Profiles & Device Management"). Find the developer or enterprise profile, tap it, tap Remove Profile, then reinstall the app and tap Trust when prompted. The reason this works is that the trust cache gets rebuilt and iOS re-runs the OCSP lookup from scratch.
Turn off the blocking DNS. If you use NextDNS, AdGuard Home, a Pi-hole, or a VPN with a blocklist, temporarily disable it. Test on cellular data with Wi-Fi off. If the app launches on cellular but not Wi-Fi, you've found the culprit — your DNS filter is dropping the OCSP request.
Check Date & Time. Sounds silly, but certificate validation depends on your clock. Go to Settings > General > Date & Time and make sure Set Automatically is on. A clock that's off by even a few hours invalidates the cert chain.
Reinstall the app. Delete it, then reinstall from TestFlight, the MDM portal, or your original install method. Don't restore from a backup — that copies the old (broken) trust record back.
Restart the device. A full shutdown, not just a lock. iOS caches the OCSP response in memory and a cold boot flushes it.

If that didn't work — alternative fixes

You're on iOS 17.4 and it's a third-party app store build

Apple's DMA changes in 17.4 (EU only) require a notarization check that some alternative-marketplace apps failed on launch. Update the marketplace app itself first, then the app. If it still fails, the developer shipped a build with a broken entitlement and only they can fix it.

Enterprise app, and you're not the developer

You can't fix this from the phone. The signing certificate is expired or revoked on Apple's side. Contact whoever gave you the app — IT, the vendor, the beta tester. Ask them for the new IPA or the updated MDM push. There is no end-user workaround. Anyone telling you to "just trust the profile again" is wrong when the cert is dead.

Free Apple ID sideload (AltStore, Sideloadly)

Free developer certs expire every 7 days. That's not a bug — that's the limit. Re-sign the app from the sideload tool and it'll work again for another week. Paid Developer accounts get 12 months.

If the app is from a company you don't recognize and you didn't install it on purpose, don't trust the profile. Delete the app. Enterprise profiles bypass the App Store review entirely, and "Unable to Verify App" is sometimes the only warning you'll get.

Preventing it next time

Two things. First, add ocsp.apple.com and crl.apple.com to your DNS allowlist — those are the endpoints iOS needs for cert checks, and a lot of "privacy" blocklists nuke them by default. Second, if you're running an enterprise or TestFlight build regularly, set a calendar reminder a month before the provisioning profile expires. Renewal takes the developer five minutes; a revoked profile kills the app for everyone at once, usually on a Monday morning when you need it most.

And one thing that doesn't help: reinstalling iOS, erasing the device, or restoring in DFU mode. I've seen people go through that whole dance only to hit the same error afterward, because the problem was never on the device.