Apple's original Developer ID certificate authority expires on 1 February 2027, breaking older Mac installersApple's original Developer ID certificate authority expires on 1 February 2027, breaking older Mac installers

Apple said on 1 October that its original Developer ID Certification Authority, the intermediate that signed Mac developers' certificates for over a decade, expires on 1 February 2027.

Developer ID is how Mac software distributed outside the Mac App Store is signed, so that Gatekeeper can check who made it. Apple's notice says certificates issued by the old intermediate will stop working on that date. Apple's public certificate page gives the exact moment as 22:12:15 UTC on 1 February 2027. Its replacement, the Developer ID G2 intermediate, runs until September 2031.

What keeps working, and what does not?

Apple separates two cases, and the difference is the whole story.

Mac apps that were signed and notarised with a secure timestamp keep working after the date. Apple says no action is needed for software already shipped that way, because the timestamp proves the signature was made while the certificate was valid.

Installer packages are different. Apple says .pkg files signed with an affected Developer ID Installer certificate will no longer install from 1 February 2027, and asks developers to re-sign every one of them before then. That includes old installers still sitting on download pages.

Future app updates must be signed with a certificate from the G2 intermediate, again with a secure timestamp. Apple's help page notes that G2 certificates last one year and need renewing annually.

How to tell whether a certificate is affected

Apple's help article gives two checks. In Certificates, Identifiers and Profiles on the developer site, any Developer ID certificate expiring on or before 1 February 2027 is affected. In Keychain Access on a Mac, the certificate's Issuer Name gives it away: an organisational unit of Apple Certification Authority means the old intermediate, while G2 means the current one.

Replacing a certificate takes the Account Holder role. When the developer site asks which intermediary to use, Apple says to pick the option labelled G2 Sub-CA, which requires Xcode 11.4.1 or later. Apple warns that choosing otherwise can produce a fresh certificate that still expires in 2027. Accounts can hold up to five certificates of each type, so a replacement can be tested before the old one lapses.

This was announced in 2022

None of this is new in principle. Apple introduced the G2 intermediate on 27 January 2022 and said at the time that existing certificates did not need to be regenerated. What has changed is that the old intermediate's end date is now four months away, and the 2026 notice is a deadline rather than a heads-up.

Our take

The app half of this is reassuring and the installer half is not. A notarised app downloaded in 2025 will still open in 2027. A .pkg on a download page that nobody has touched since 2023 will not install, and the person who finds out will be a customer, not the developer. APPDOOK's advice to anyone who distributes Mac software directly is to list every installer they still link to, not only the current release.

Apple has form here, and so do developers. When the original WWDR intermediate expired in February 2016, some developers were caught out on the day. Apple is giving four months' notice this time, but its notice does not say which macOS versions enforce the cut-off, nor what happens to software signed without a secure timestamp. The safest reading of that silence is that untimestamped signatures should be treated as affected too.

For Mac users, the practical effect should be nothing, as long as developers act. Gatekeeper is only as useful as the signatures it checks, and a fake Zoom installer that talked users past Gatekeeper showed this week how readily people click through a warning. An expired installer produces a similar warning for a legitimate reason, and teaching users to override it is the worst possible outcome of a certificate deadline.