Once you get the special entitlement for hotspot helper and add that to your provisioning profile, do you still have to manually go in and change the entitlements of your app and set com.apple.developer.networking.HotspotHelper to true? I'm asking because if I don't do that then hotspot helper doesn't successfully register and the SPN feature won’t work. When I look into the macOS console I get: missing com.apple.developer.networking.HotspotHelper Basically are special entitlements different, so you have to go in and manually add the key into your entitlement?

I was having similar issues. The root cause of it was due to Apple's 'data protection class'. It's defaulted to NSFileProtectionCompleteUntilFirstUserAuthentication I was seeing this error for the longest time until I accidentally reproduced it. I only ran into this issue: after a reboot did NOT unlock device. app made some network call that needed to write into some directory Failed and got a 513 error. The fix is simple if you like the tradeoff: try data.write(to: tmpFileURL, options: [.noFileProtection]) Though that would allow the file to be accessed while locked and during boot time. I suppose if you've set the data protection class to NSFileProtectionCompleteUnlessOpen and the user locks their device after an action and that action of yours takes too much time then you'll get this error again.

Every App extension needs its a provisioning profile. I got mine to work with a provisioning profile that didn't need capabilities.