Profile doesn't support Network Extensions.

Show that app's .entitlements plist file

<key>com.apple.developer.networking.networkextension</key>
<array>
  <string>app-proxy-provider</string>
  <string>packet-tunnel-provider</string>
</array>

Your

.entitlements

file looks OK [1] but that’s only one input to the code signing story. The other input is your provisioning profile, which has to whitelist these entitlements. When you go to export the production app, do you get to the Select certificate and ioS App Store profiles stage? Once you select your distribution profile and click Next, do you then get to the next state, Review ***.ipa content? Or does it fail before getting there?

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

[1] It’s a bit weird that you’ve included

app-proxy-provider

when you’re only building a packet tunnel provider.

I can go upto 'select certificate and developer ID profiles'. While selecting my app's provisioning profile it says 'Profile doesn't support Network Extensions.'

While selecting my app's provisioning profile it says 'Profile doesn't support Network Extensions.'

Sounds like you need to enable the NetworkExtension entitlement on your distribution profile. Normally the profile picks this up from your App ID, and it’s curious that’s not happened here.

Anyway, here’s what I recommend.

1. Go to your account page on the developer web site.

2. Click Certificates, IDs & Profiles.

3. Click Identifiers > App IDs.

4. Click on your app’s App ID.

5. Click Edit.

6. Enable the Network Extensions checkbox.

7. Now got through and rebuild your distribution profile so that it picks up the entitlement change from your App ID.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

My App ID has Network Extensions enabled already. I have tried with different App ID too, still the problem occurs. But running from Xcode works fine.

The next step here would be to get a copy of the profile it’s trying to use, decode it, and then look to see if it correctly lists the NE entitlements you need. For example:

$ security cms -D -i 8023fbe6-4879-4ef3-95c6-e129ae60ffe4.mobileprovision 
…
<dict>
    …
    <key>Entitlements</key>
    <dict>
        <key>com.apple.developer.networking.networkextension</key>
        <array>
            <string>app-proxy-provider</string>
            <string>content-filter-provider</string>
            <string>packet-tunnel-provider</string>
            <string>dns-proxy</string>
        </array>
        <key>application-identifier</key>
        <string>SKMME9E2Y8.com.example.apple-samplecode.QNEPacketTunnel-iOS</string>
        <key>keychain-access-groups</key>
        <array>
        <string>SKMME9E2Y8.*</string>
        </array>
        <key>com.apple.developer.team-identifier</key>
        <string>SKMME9E2Y8</string>
    </dict>
    …
</dict>
</plist>

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

NE entitlements is missing in my provisioning profile.

<key>Entitlements</key>

<dict>

<key>com.apple.developer.aps-environment</key>

<string>production</string>

<key>com.apple.application-identifier</key>

<string>TeamID.com.company.app-mac</string>

<key>keychain-access-groups</key>

<array>

<string>TeamID.*</string>

</array>

<key>com.apple.developer.team-identifier</key>

<string>TeamID</string>

</dict>

But in Developer portal it showing like below and my AppID has NE enabled.

Enabled Services:In-App Purchase, Network Extensions, Push Notifications

Sounds like you need to regenerate your profile.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

I have regenerated the profile. No luck, Still NE entitlements is missing in my provisioning profile.

I have exactly the same issue here. If I generate a distribution/developer profile, it works perfectly fine. However if I generate a developerID profile, it just shows missing that network extension error.

It's actually a bit different. After decoding, mine does have networkextension in the config. However the xcode still showing doesn't match the entitlements file's value for the com.apple.developer.networking.networkextension entitlement.

<dict>

<key>com.apple.developer.networking.networkextension</key>
<array>
<string>packet-tunnel-provider-systemextension</string>
<string>app-proxy-provider-systemextension</string>
<string>content-filter-provider-systemextension</string>
<string>dns-proxy-systemextension</string>
<string>dns-settings</string>
</array>

<key>com.apple.application-identifier</key>
<string>*</string>

<key>keychain-access-groups</key>
<array>
<string>*</string>
</array>

<key>com.apple.developer.team-identifier</key>
<string>*</string>

</dict>

I was facing similar issue while building a packet tunnel provider and I changed the entitlements to packet-tunnel-provider-systemextension (in both the app and appex entitlements file) and it seems to be working.