aps-environment is always development

You can't use a production certificate in debug/development. Even if you do it, then, when you 'Archive', Xcode will automatically set it to production (Apple reference). You can see this when you try to submit your app to iTunes connect for TestFlight/Review or for Adhoc deployment.

Xcode 8:

Xcode 9:

There is a known bug in Xcode whereby manually setting this to 'production' causes Xcode to display an error next to your entitlements config with a 'Fix Issue' button. Clicking this sets it back to 'development' This is not intended functionality. As I said it is a known issue and I believe I filed a radar when I first discovered it.

It has been fixed in Xcode 8.3 beta 2. In the meantime, manually set it to 'production' and then ignore the error Xcode gives you, your project will work just fine.