I was trying to update one of my apps today, and since my provisioning profile had expired I was forced to create new ones. Obviously this was not a painless process.
Mainly, after a process of deleting all old one’s and downloading new, fresh profiles and certificates validation would still fail with an error: “Invalid IPA: The keychain-access-group in the embedded.mobileprovision and your binary don’t match”, what does this mean, you ask? Well after an hour spent debugging this, I’m still not 100% sure of the cause. But what solved it for me was to create an entitlements file for the project by checking “Keychain Sharing” in the project settings, then open the generated entitlements file in a text editor and manually replacing (AppIdentifierPrefix) with the identifier prefix for my app (you can find this by opening your distribution provisoning profile at developer.apple.com, it’s the part before the specifier “XXXXXXX.com.hjnilsson.appname” and that ought to allow you to submit the app error-free.