I can not pick a correct CFBundleIdentifier value it seems.
...
in KeyChain I have this certificate:
iPhone Distribution: Ex
I was struggling with the same problem, I found this link http://embarcadero.newsgroups.archived.at/public.delphi.deployment/201308/1308131098.html
I just hadn't set the CFBundleIdentifier in Debug although I was deploying for Release. I hope this will help you to solve your issue.
Ditching the wildcard app ID worked for me. Hence I chose the other option in iTunesConnect resulting it in showing me BundleID as being com.example.appname. I then made sure 1) my provisioning for distribution used DistCertificateID.com.example.* 2) to set CFBunldeIdentifier (in Delphi) as same shown in iTunesConnect. I then built and deployed followed by submitting it to Application Loader.