Apple says the original Developer ID Certification Authority (Sub-CA) expires on February 1, 2027, and Mac installer packages signed with a certificate from that authority will no longer install starting that date. The company posted the warning on its developer news site on October 1, 2026, and says previously signed and notarized Mac apps with a secure timestamp will keep working.
That split matters. Apps you already have, and app downloads that were notarized properly, are not the problem. The risk is the .pkg installer file, which Apple’s notice singles out.
What changes on February 1, 2027
Apple’s Developer ID page describes the certificate as what lets Gatekeeper verify “that you’re a trusted developer when people download and open your app, plug-in, or installer package from outside the Mac App Store.” Those certificates are issued by a Developer ID Certification Authority, or Sub-CA, and the original one is running out.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
In its Developer ID Sub-CA expiration notice, Apple says “Certificates issued by this authority will stop working on that date.” For installers, the wording is blunt: “Starting February 1, 2027, .pkg files signed with an affected certificate will no longer install.”
The replacement is the current authority, Developer ID Certification Authority (G2). Apple says this certificate authority is valid until 2031, but the certificates it issues “expire annually and must be renewed each year.”
Here is how Apple breaks it down by what a developer ships:
| What you distribute | What Apple says happens | What to do |
|---|---|---|
| Installer packages (.pkg) signed with an affected certificate | Will no longer install starting February 1, 2027 | Re-sign all packages with a new certificate before that date |
| Mac apps previously signed and notarized with a secure timestamp | Will keep working | No action needed |
| Future Mac app updates | Apple asks developers to use the new certificate | Sign with the new certificate and include a secure timestamp for notarization |
What it means if you just install Mac software
Most Mac owners will not need to do anything. Apps already on your Mac that were signed and notarized with a secure timestamp fall under Apple’s “will keep working” line.
Where you could notice it is with installer files you keep around. If you save .pkg installers for reinstalling a printer driver, an audio plug-in or a work tool, a package signed with an old certificate will not install after February 1, 2027. Once the developer re-signs it, getting a fresh copy of the installer from the developer is the way around that.
IT teams that deploy software through .pkg files should check with their vendors, and with their own internal packaging, well before that date.
How developers can check if they are affected
Apple’s help page for replacing Developer ID certificates from the previous Sub-CA lists the steps. The required role is Account Holder.
- In Certificates, Identifiers & Profiles, click Certificates in the sidebar and review your Developer ID Application and Developer ID Installer certificates.
- Any certificates expiring on or before February 1, 2027, are likely affected.
- The expiration date alone does not prove which authority issued a certificate. A team can hold two certificates with identical names, differing only in expiration date.
- To be certain, select the certificate in Keychain Access, expand the Issuer Name field and check the Organizational Unit field.
If the Organizational Unit reads Apple Certification Authority, the certificate came from the previous Sub-CA and needs replacing. If it reads G2, it came from the current Sub-CA and no action is needed.
One catch Apple flags: check your own certificate, not the Developer ID Certification Authority entry in your keychain. That entry is the authority itself, and it is issued by Apple Root CA, whose Organizational Unit is also Apple Certification Authority.
How to create a replacement certificate
Apple notes that if you are using Xcode 11.4 or earlier, you should update before creating the new certificate. Then:
- Sign in to Certificates, Identifiers & Profiles, click Certificates in the sidebar, then click the add button (+).
- Under Software, select Developer ID Application or Developer ID Installer, then click Continue. If you hold both types, repeat the steps for each, since one certificate does not cover the other.
- If you are asked to select a Developer ID Certificate Intermediary, choose G2 Sub-CA (Xcode 11.4.1 or later). Apple warns that choosing another option may issue a certificate that also expires in 2027.
- Create a certificate signing request, upload it, then download your new certificate.
- Double-click the downloaded file to install it in your keychain, then update your systems to sign with the new certificate.
Teams can hold up to five Developer ID Application and five Developer ID Installer certificates at a time, so Apple says you can create and test a replacement before your current certificate expires.
Re-sign installers, not shipped apps
The practical to-do list is short. Re-sign every .pkg you still distribute with the new G2 certificate before February 1, 2027. Sign future app updates with the new certificate and include a secure timestamp for notarization. Leave already notarized apps alone.
Because G2 certificates expire every year, it is also worth putting the annual renewal on the calendar now, rather than finding out from a support ticket that an installer has stopped working.
