Developer ID Certificates Expire February 1, 2027: What to Do

On October 1, 2026, Apple announced that the original Developer ID Certification Authority expires on February 1, 2027. Every Developer ID certificate issued by that authority stops working on the same day.

If you ship a Mac app outside the App Store, you may have signed it with one of these certificates. Here is what breaks, how to check, and how to replace it.

What stops working

  • Installer packages: .pkg files signed with an affected certificate will no longer install, starting February 1, 2027.
  • New releases: you cannot sign new builds or updates with the old certificate after that date.
  • Apps you already shipped: these keep working. Apple says software that is already signed and notarized with a secure timestamp needs no action.

Re-sign every .pkg with a new certificate before February 1. Your next release also needs the new certificate.

Check if your certificate is affected

  1. Open Keychain Access and find your Developer ID Application certificate. Skip the Developer ID Certification Authority entry: that is the authority itself, and its issuer always shows Apple Certification Authority.
  2. Expand Issuer Name and look at Organizational Unit.
  3. If it says Apple Certification Authority, the certificate comes from the expiring authority. Replace it.
  4. If it says G2, you are fine.

From the terminal, print the subject and issuer of every Developer ID Application certificate in your keychain:

security find-certificate -a -c "Developer ID Application" -p \
  | openssl crl2pkcs7 -nocrl -certfile /dev/stdin \
  | openssl pkcs7 -print_certs -noout

An issuer with OU=G2 is the new authority. An issuer with OU=Apple Certification Authority is the expiring one.

Do the same check for your Developer ID Installer certificate if you ship .pkg files. In the command, replace -c "Developer ID Application" with -c "Developer ID Installer".

Replace it

You need the Account Holder role on the team.

  1. Sign in to Certificates, Identifiers & Profiles.
  2. Click the add button (+).
  3. Under Software, select Developer ID Application (or Developer ID Installer) and click Continue.
  4. When asked for the Developer ID Certificate Intermediary, choose G2 Sub-CA (Xcode 11.4.1 or later). Apple warns that any other option can issue another certificate from the expiring authority.
  5. Upload a certificate signing request, download the certificate, and double-click it to install it.

Repeat these steps for each certificate type you use. A Developer ID Application certificate does not cover installer packages, and the reverse is also true.

A team can hold up to five Developer ID Application and five Developer ID Installer certificates at a time, so you can create the new one now and test it before the old one expires.

If your team already holds five, revoke one you no longer use. Never revoke a certificate that signed a build you shipped: Apple says an app signed with a revoked Developer ID certificate can no longer be installed, and stops launching if it is already installed.

Apple says certificates from the G2 authority are valid for one year and must be renewed annually. Put the expiry date of your new certificate in your calendar.

Update everything that signs your app

The new certificate only helps if every build uses it:

  • Your Mac: select the new identity wherever you sign. In Amore, pick it in the Code Signing settings. The old and new certificates have the same name, so codesign can stop with an "ambiguous" error while both are in your keychain. After the switch, delete the old certificate from your keychain, or sign with the SHA-1 hash that security find-identity -v -p codesigning prints.
  • CI: export the new certificate as a .p12 with a new password, and replace both secrets. For the Amore GitHub Action these are DEV_ID_CERT_P12 and DEV_ID_CERT_PASSWORD. See GitHub Actions.
  • Provisioning profiles: a Developer ID provisioning profile lists the certificates it accepts. If your app uses one, regenerate it with the new certificate. See Provisioning Profiles.
  • Sparkle: do not generate a new EdDSA key. Your update signing key has nothing to do with the Developer ID certificate.

Then ship one release with the new certificate, well before February 1, and confirm that notarization passes and that an existing install updates to it.