I'm getting the following error message from Xcode 9 GM when trying to do an Ad Hoc distribution export of an iOS app archive from the Organizer.
Profile doesn't match the entitlement file's value for the application-identifier entitlement.
The bundle identifier and the App ID do match. I never got this message for the same project with Xcode 8. So where is the new mismatch? Something I need to do in Xcode? Or is there some new setting when creating an App ID or Ad Hoc distribution provisioning profile in iTunes Connect?
The mismatch is in the provisioning profile being used. I can't tell you why, but the entitlements are being extracted from your provisioning profile during signing, based on the portal appID that profile was created from. There's a mismatch between the bundle ID of the target you built and the bundle ID of the portal's appID record that the signing provisioning profile was created with.
First, make sure that the profile is the one you're meaning to use (the AdHoc Distribution provProf for a portal appID that matches the bundle ID of your target, and if that looks right, consider regenerating the AdHoc provisioning profile and installing it using the Xcode>Preferences >Accounts "Download Manual Profiles" option.
Sometimes Xcode will get confused if you have old versions of provisioning profiles installed, and I've even seen times in the past where a wild card profile was matching instead of the intended one. So, there could be some Xcode confusion around the installed provProfs. The fact that you had no issues with Xcode 8 but do with Xcode 9 might explain that. Changes in Xcode can cause changes in behavior.
If regenerating the provProf and installing it doesn't help, I'd suggest deleting all of your installed mobile provProfs and then reinstalling them. To delete them, open a terminal window and enter
rm ~/Library/MobileDevice/"Provisioning Profiles"/*.mobileprovision
Then go back to the Xcode>Preferences>Accounts and do the "Download Manual Profiles" option to install them again. If it still doesn't work, you're missing something. See the debugging tip below.
Focus on the appID's bundle ID in the Dev portal, the bundle ID of your target, and the provisioning profile you're signing with (making sure it's for an AdHoc build of that appID). At least one of those isn't matching up.
One last debugging tip. Drag the provisioning profile you're signing with to TextEdit (I keep that in my dock for pretty much this reason.) TextEdit will display the information in the provProf, so you can check the entitlements and make sure they match what you're expecting.
Hopefully that's enough to sort this out.