Developer ID Sub-CA expiration: what breaks on February 1, 2027 and how to replace your certificate

In Certificates, Identifiers & Profiles, open Certificates and review your Developer ID Application and Developer ID Installer certificates. Any that expire on or before February 1, 2027 are likely affected, but the date alone does not prove the issuer, and a team can hold two certificates with identical names. To be sure, select your certificate in Keychain Access, expand Issuer Name and read the Organizational Unit: «Apple Certification Authority» means the old Sub-CA, replace it; «G2» means the current Sub-CA, nothing to do. Check your own certificate, not the Developer ID Certification Authority entry itself, which also shows «Apple Certification Authority» because Apple Root CA issued it.

The Account Holder creates it. In Certificates, click the add button, choose Developer ID Application or Developer ID Installer under Software, and repeat for the other type if you use both, since one does not cover the other. When asked for a Developer ID Certificate Intermediary, pick G2 Sub-CA (Xcode 11.4.1 or later); any other option may issue a certificate that also expires in 2027. If you still use Xcode 11.4 or earlier, update first. Upload a certificate signing request, download the certificate and double-click it to install it in your keychain. You can hold up to five certificates of each type, so you can create and test the replacement while the old one still works.

The G2 authority itself is valid until 2031, but the certificates it issues expire annually and must be renewed each year. Put the renewal in your release calendar and in your CI secrets rotation, so a build server does not start failing on the anniversary.

Re-sign every installer package you distribute, including ones on your website or in an update feed, before February 1, 2027. Then point your build scripts, CI and notarization step at the new identity, and keep the secure timestamp when you sign, because notarization needs it. For other Mac platform changes this cycle, see the Rosetta 2 end of support guide.

Keeping your Mac app installable keeps the people you already won; being found brings new ones. Censuus ranks apps by the visits they draw, and adding your app is free on the List my app form. Placement comes from traffic and sponsorship: apps climb on the visits they draw, and a sponsor can pay to rise higher.