Mac developers distributing software outside the App Store should check their installer downloads before February 1, 2027. Apple’s original Developer ID Certification Authority expires that day, with consequences that depend on how the software was distributed.
Apple’s October 1 notice says .pkg installers signed with certificates from the affected authority will stop installing. Developers need to re-sign those packages with a replacement certificate. The practical implication: updating a signing setup for future releases does not repair older installers still offered for download.
Previously signed and notarized Mac apps with a secure timestamp will keep working, Apple says. Future app updates should use the replacement certificate and include a secure timestamp for notarization.
Check the issuer
Apple’s replacement guide explains why an expiration date is only a starting point. Review both Developer ID Application and Developer ID Installer certificates; the two serve different purposes and need separate replacements if both are affected.
In Keychain Access, select your own signing certificate and inspect Issuer Name → Organizational Unit. “Apple Certification Authority” identifies the previous authority; “G2” identifies the current one. Inspect the signing certificate itself: the intermediate authority’s separate entry can also show “Apple Certification Authority,” creating an easy opportunity for confusion.
Plan for existing downloads
For distribution teams, a useful next step is to inventory the .pkg downloads they still support and schedule replacement packages before the deadline. That follows from Apple’s installer warning, rather than requiring every previously shipped app to be rebuilt.
Apple identifies the Account Holder as the role required for certificate replacement. Its guide also says teams can hold up to five certificates of each type, allowing a replacement to be tested before the current one expires.
Replacement G2 certificates are valid for one year, so annual renewal also belongs in the release plan.
Sources
Apple Developer Account Help: Replacing Developer ID certificates issued from the previous Sub-CA (checked October 13, 2026)
