Apple is overhauling the security certificates it hands to Mac developers, and the change carries a hard deadline that could stop older installer packages from working at all.
The company now issues Developer ID Application and Developer ID Installer certificates from a different certification authority – referred to inside the certificates as G2 – and cuts their lifespan from five years to one. Developers must therefore mint fresh certificates annually and switch their signing workflows over. For apps, that is an administrative annoyance rather than a user-facing break, because a notarized app with a trusted timestamp keeps launching after its certificate expires, provided the certificate was valid when the timestamp was applied.
Installer packages play by different rules, and this is where the risk concentrates. Apple warns that from February 1, 2027, .pkg files signed with an affected certificate will refuse to install, telling developers to re-sign all packages before that date. Historically such packages required a still-valid certificate at install time, a constraint Apple only later relaxed to match app behavior for timestamped signatures.
Whether every signed installer package follows the newer, more forgiving rule is unstated. That ambiguity means users of software distributed as a .pkg – common for utilities, drivers and enterprise tools – may discover the limits of the policy only when an installer unexpectedly declines to run.
Disk images sit outside the problem. Signed .dmg files use Developer ID Application certificates, so they inherit the app rules and keep working past certificate expiry.
The practical effect is a deadline that falls on developers but lands on whoever tries to install their older packages. Anyone running a Mac in a managed fleet should expect a wave of re-signed installers in the coming months.
