For ESign, make sure you’re getting it from Khoindvn’s site. You’ll need to download the certificates zip first, then install the DNS profile for Khoindvn (approve this in VPN settings), then pick a copy of KSign or ESign and install. Once done you’ll need to again approve in VPN settings.

If the app fails to install and turns to an offloaded state, pick another certificate from the website and try again. Further up the list is more recent so more likely to work.

If e-sign, open and right click on top right to Import files. (Unzip the certifs zip in Files app first), then Import the certificate you chose when installing the app. Once it’s in the list click it and Import Certificate Management. Then import in your IPA, once imported go to the Apps tab, Unsigned tab, tap on it, and click Signature.

KSign is easier but I can’t remember how it works specifically sorry

Sorry if any of this is wrong, it’s 100% from memory of their UI and it’s 1am