Hello Apple Developer Support,
We are seeking clarification regarding the impact of the upcoming certificate changes taking effect on February 1, 2027.
Our organization has previously distributed macOS installer packages (.pkg) that were:
• Signed using a Developer ID Installer certificate that chains to the Developer ID Certification Authority intermediate certificate expiring on February 1, 2027.
• Successfully notarized by Apple.
• Signed with a secure timestamp.
We are specifically seeking clarification on the impact of the Developer ID Certification Authority intermediate CA expiration on packages that were signed, securely timestamped, and successfully notarized prior to the expiration date.
We would like to understand how these existing packages will be treated after February 1, 2027.
Questions
-
Will installer packages (.pkg) that were already signed, timestamped, and notarized before February 1, 2027 continue to install successfully after that date?
-
Does notarization combined with a secure timestamp allow these previously distributed packages to remain trusted and installable after the certificate changes take effect?
-
Are software vendors required to re-sign and re-notarize installer packages that have already been distributed if they were signed using certificates affected by this change?
-
If re-signing is required, does this apply to:
• Only new packages created after February 1, 2027, or
• Existing packages that were previously notarized and distributed? -
Are there any recommended validation steps to determine whether an existing notarized package will continue to install successfully after February 1, 2027?
Business Impact
We are evaluating whether previously released installer packages signed with Developer ID Installer certificates that chain to the expiring Developer ID Certification Authority intermediate CA will remain deployable for customers after February 1, 2027, and whether any re-signing or re-notarization effort is required for our existing catalog of notarized installers.
Without clarification, we cannot determine whether archived installers will continue to function as expected or whether remediation work is required to preserve the installability of previously released software versions.
Thank you for your guidance. We would appreciate any relevant documentation or recommendations regarding best practices for existing notarized installer packages.