I've spent a ton of time with provisioning profiles, and even managed to release a few apps, so I'm familiar with the process. However, I've come across an issue and I'm not sure what to do.
In my Keychain access, I had a ton of keys and certificates, a lot of which were unfamiliar. Perhaps unwisely, I deleted them all, in order to re-add the correct ones. (I now realise this was a bad idea).
In the developer portal, I realised my Development and Distribution certificates were about to expire, so I revoked and recreated them. (Also, I'm guessing a bad idea). In doing so, I obviously invalidated all my provisioning profiles. So, I recreated them all with the new certificates.
The problem I'm having now, is that when I add the new provisioning profiles to Xcode, the distribution certificates (Ad Hoc and App Store) both appear valid. However my development profiles (and the iOS Team profile *) all say 'Valid signing entity not found'.
By deleting my local certificates, revoking the online ones, reissuing them and recreating my provisioning profiles, have I totally messed things up?
I agree, this is still a very complicated area even after several years. I think, you should not be able to totally mess thing up like this. If you created a new signing request and all new certificates you should be fine. However, I remember several hidden issues that may appear.
First is the duplicated certificates in the keychain. This may happen if your first certificate has expired and you generate another one with the same signing request you used before. In this case Xcode somehow may pick the wrong one. However, if you cleaned them all and generated new certificates with the new signing request this should not be a problem.
Second, Xcode needs to be quit and relaunched after you added new certificates. Maybe in the new one it is not an issue any more, but it definitely was. Also, Xcode caches the Provisioning Profiles in the Organiser. If you decided to clean everything up do not forget to clean them too.
And the last, make sure Code Signing Identity in the target settings really use the new profiles. If you use the same naming in the old once and new once it is easy to confuse them. Try to change names formats of the new Provisioning profiles, so you could distinguish them from the old once. I hope this helps.