Sometime, in Xcode 8 you might find yourself in a revoke-regenerate cycle, where you let Xcode 8 "fix" the certificates and provisioning, then Xcode finds the new/regenerated certificates to be invalid also, and you go back to revoke, and it keeps happening.
In such cases, check your MacOS time! If you have it set to some other time, not the real current time, the new certificate may always "not yet" be valid.