title: Certificates, Provisioning Profiles, public/private keys demystified
body: <p>This topic continues to confuse me. I thought I'd write out my current understanding and hopefully find out the things I'm right about/things I'm wrong about. </p>
  
  <p>When you create a development certificate, there is a concept of a public and private key. The certificate available thru the provisioning portal holds on to a public key, while your private key is stored within your keychain. In order to code sign your app, you've got to have both. </p>
  
  <p>In order to run an app, the device must have a provisioning profile, which essentially holds on to an app identifier, a set of recognized certificates (the app must've been signed by one of these certificates), and a set of device identifiers (which indicate which devices are allowed to run the app). </p>
  
  <p>The 'recognized certificates' have references to the public key, while the private key is essentially passed on by the app. </p>
  
  <p>Thus, with regards to the App Store, we can think of a normal device as coming with a default prov profile that already has apples 'public key' and apple performs their own code sign operation before distributing whereby they add their private key. </p>
  
  <p>Perfect? Close? Way off? Insane?</p>