The hardest part of iOS distribution usually isn't packaging. It's the user who comes back with "it won't install" and no other detail. Here are the failures I get asked about most, sorted by the exact text people see on screen — with the cause and the fix.
"Unable to Install [App]"
The common one, and nine times out of ten it's signing or the device. Either the .ipa was built with a provisioning profile that doesn't include this device's UDID, or the plist on the install link doesn't carry the right signing info. Confirm the UDID was in the profile at build time, then check that the install page is HTTPS and the plist is reachable.
"Untrusted Enterprise Developer"
Unavoidable with enterprise-certificate distribution. It's not an error, it's the standard iOS flow: after installing, go to Settings → General → VPN & Device Management, find the certificate, tap Trust. A lot of users stall right here, so put these steps on your download page with screenshots rather than letting them figure it out.
"This Certificate Has Expired"
The enterprise certificate or provisioning profile ran out. Enterprise certs renew roughly once a year and profiles expire too; once they do, every package signed with the old one stops installing. Track the expiry dates and re-sign ahead of time. Far cheaper than firefighting later.
"Cannot Connect to [Server]"
Usually the plist behind the itms-services link can't be fetched. Check that it's served over HTTPS, and that the link isn't being swallowed by a firewall or an in-app browser like WeChat's. In mainland China specifically, double-check the domain is directly reachable.
One small trick for supporting users remotely: ask them to screenshot the exact error text rather than describe it. iOS's wording maps almost one-to-one to the categories above.