Apple is warning Mac developers to check their Developer ID certificates ahead of the expiration of its original Developer ID Certification Authority on February 1, 2027.

Certificates issued by the original Developer ID Certification Authority will stop working on that date. Apple is asking developers with affected certificates to replace them with certificates issued by its current Developer ID Certification Authority, known as the G2 Sub-CA.

The warning applies to developers who use Developer ID certificates to sign Mac software distributed outside the Mac App Store. Apple says developers should check their certificates now rather than wait for the old certification authority to expire.

What developers need to do

Developers can check their Developer ID Application and Developer ID Installer certificates through Apple’s Certificates, Identifiers & Profiles portal. Certificates expiring on or before February 1, 2027 are likely to be affected, although Apple says the expiration date alone doesn’t confirm which authority issued a certificate.

To confirm, developers can open the certificate in Keychain Access and expand the Issuer Name field. If the Organizational Unit shows “Apple Certification Authority,” the certificate was issued by the previous Sub-CA and needs to be replaced. Certificates showing “G2” were issued by the current Sub-CA and don’t require replacement because of this expiration.

Apple says developers should create replacement certificates from the G2 Sub-CA. The G2 certificate authority is valid until 2031, although individual certificates issued by it are valid for one year and need to be renewed annually.

Developers using Xcode 11.4 or earlier should update Xcode before creating a replacement certificate. When Apple asks developers to select a Developer ID Certificate Intermediary, they should choose the G2 Sub-CA. Selecting another option could result in a certificate that also expires in 2027.

Mac installers face a hard deadline

The February 1, 2027 deadline is particularly important for developers distributing Mac installer packages.

Apple says .pkg files signed with an affected certificate will no longer install starting February 1, 2027. Developers distributing those packages need to re-sign them with a new certificate before the deadline.

Developers can create and test replacement certificates before their existing certificates expire. Apple allows a team to hold up to five Developer ID Application certificates and five Developer ID Installer certificates at a time.

Existing Mac apps won’t suddenly stop working

The certificate transition does not mean every Mac app signed with an affected certificate will stop working on February 1.

Apple says previously signed and notarized Mac software with a secure timestamp will continue working after the old certification authority expires. Developers don’t need to re-sign those existing apps solely because of the February 2027 expiration.

Future updates are different. Developers should sign updates with a replacement certificate and include a secure timestamp when notarizing them.

That makes the upcoming deadline primarily a developer-side signing and distribution change rather than a blanket shutdown of existing Mac software.

Apple recommends that developers identify affected certificates and move their signing workflows to the G2 Sub-CA ahead of the February 1, 2027 deadline.