macOS Code Signing Certificate
For macOS software distributed outside the Mac App Store, the relevant signing identity is an Apple Developer ID certificate. Developer ID Application is used for applications and executable code, while Developer ID Installer is used for installer packages.
macOS Code Signing Certificate Pricing
Apple does not sell Developer ID Application and Developer ID Installer certificates as separate third party CA products. The main entry cost is Apple Developer Program membership, while signing infrastructure can add costs depending on how you build and distribute your software.
| Cost item | Current cost | What it covers | When you need it |
|---|---|---|---|
| Apple Developer Program | $99/year | Membership access to Apple developer resources, certificates, identifiers, profiles and distribution capabilities. | Required for the standard Developer ID distribution workflow. |
| Developer ID Application | Included with membership | Certificate used to sign Mac applications and executable code distributed outside the Mac App Store. | When distributing signed Mac applications directly. |
| Developer ID Installer | Included with membership | Certificate used to sign Mac Installer Packages containing signed applications. | When distributing signed .pkg installers. |
| Apple notarization | Apple does not list a separate notarization fee | Apple's automated service checks submitted software and issues a notarization ticket when accepted. | For applicable software distributed outside the Mac App Store. |
| Mac build infrastructure | Varies | Mac hardware, hosted Mac runners or other build infrastructure. | When signing is automated or builds are not performed on a developer Mac. |
| Cloud, remote or HSM signing | Provider dependent | Key protection and signing infrastructure operated outside the normal developer workstation. | When an organization centralizes or hardens signing operations. |
Pricing note: Apple currently lists the Apple Developer Program at $99 USD annually. Regional pricing, taxes and eligibility can affect the amount charged. Apple lists Developer ID Application and Developer ID Installer as certificate types available through the developer account rather than separate certificate purchases.
What Is a macOS Code Signing Certificate?
A macOS code signing certificate is part of Apple's signing identity system used to establish who signed software and whether signed code has been changed. For software distributed outside the Mac App Store, Apple uses Developer ID certificates rather than the generic public CA certificates commonly associated with Windows Authenticode.
A Developer ID signing identity combines the certificate with its corresponding private key. The private key performs the signing operation, while the certificate identifies the developer identity associated with the signature. Apple documents Developer ID certificates specifically for Mac software distributed outside the Mac App Store.
This distinction matters when a buyer searches for a macOS code signing certificate. A DigiCert, Sectigo, SSL.com, or other generic CA code signing product should not be presented as an equivalent replacement for a Developer ID Application certificate.
Developer ID Application vs Developer ID Installer
Apple provides two Developer ID certificate types for different signing targets. Choosing the correct one is part of a reliable macOS release process.
| Signing identity | Used for | Typical artifact |
|---|---|---|
| Developer ID Application | Signing applications and executable code | .app, executable code, nested components |
| Developer ID Installer | Signing Mac Installer Packages | .pkg |
| Mac App Store workflow | Apple's App Store distribution and signing workflow | App Store submission artifacts |
Do not substitute the two Developer ID certificates. Developer ID Application identifies and signs the application code. Developer ID Installer signs an installer package containing the signed application.
Does Apple Issue a macOS Code Signing Certificate?
Yes. Apple issues Developer ID certificates through the Apple Developer account system. Apple currently allows an Account Holder to create up to five Developer ID Application certificates and up to five Developer ID Installer certificates, with cloud-managed Developer ID certificates also available for eligible roles.
Apple Developer Account → Developer ID certificate → private key → signing identity → signed software
The certificate is only one part of the identity. The corresponding private key is what allows a build system or developer machine to create a signature. Apple provides the certificate through its developer account infrastructure and the certificate is installed into the Mac Keychain for signing.
macOS Code Signing vs Windows Code Signing
The same search phrase can describe very different ecosystems. macOS and Windows use different certificate authorities, signing tools, trust models, and distribution controls.
| Area | macOS | Windows |
|---|---|---|
| Primary signing ecosystem | Apple Developer | Public CAs + Authenticode |
| Application signing | Developer ID Application | Authenticode |
| Installer signing | Developer ID Installer for .pkg | Authenticode for applicable executables/installers |
| Main signing tool | codesign | SignTool |
| Distribution security | Gatekeeper + notarization | SmartScreen and Windows trust mechanisms |
| Certificate source | Apple Developer | Public CA providers |
What Can You Sign on macOS?
macOS code signing is applied to executable code and application components. A release can contain multiple nested signed objects, so the final application depends on the integrity of the signing structure.
Applications
The main .app bundle and its executable code.
Nested code
Frameworks, helper apps, dynamic libraries, plug-ins and other executable components.
Installer packages
A .pkg can be signed with Developer ID Installer.
Distribution artifacts
DMG files and other deliverables can participate in notarization workflows.
App extensions
Extensions and executable components must be signed consistently with the application architecture.
Frameworks and libraries
Embedded frameworks and libraries must be correctly signed before the final bundle is sealed.
DMG is different from the application inside it. A disk image is a distribution container. The application inside it still needs its own appropriate signing, and a disk image can also be submitted to Apple's notary service.
How macOS Code Signing Works
The practical release chain is more than placing a certificate on an application. The signing identity, code signature, entitlements, nested code, notarization and Gatekeeper all have separate roles.
Developer ID
Apple issued signing identity.
Code sign
codesign creates signatures.
Seal resources
Bundle resources are covered by the signature.
Verify
Check signature, identity and requirements.
Notarize
Submit software to Apple's notary service.
Distribute
Package and deliver the release.
Gatekeeper
macOS assesses the software when opened.
Certificate and private key
The certificate identifies the Developer ID identity. The corresponding private key is required to create signatures.
Entitlements and Hardened Runtime
Signing configuration also interacts with capabilities, entitlements and the Hardened Runtime requirements used for notarized software.
What Does a macOS Code Signature Prove?
A valid signature gives a specific set of assurances. It should not be treated as a general software safety certificate.
It can establish
- The signing identity associated with the code
- That signed code has not been modified since signing
- The certificate chain associated with the signing identity
It does not prove
- The software contains no vulnerabilities
- The software is free of malicious behavior
- The developer is trustworthy in every respect
What notarization adds
Apple's notary service scans submitted software for malicious content and code signing issues and provides a notarization ticket when the submission is accepted.
Developer ID and Gatekeeper
Developer ID signing and Gatekeeper are connected, but they are not the same mechanism. Developer ID provides the signing identity that Gatekeeper can evaluate when software is distributed outside the Mac App Store.
Apple describes Gatekeeper as the macOS security technology that helps protect users when they install software from outside the App Store. Gatekeeper checks whether software is from a known developer and whether it has been altered. Notarization adds Apple's assessment and a ticket that Gatekeeper can use.
Signed software
A valid Developer ID signature identifies the signer and protects code integrity.
Notarized software
Apple has processed the submitted software through its notary service and issued a ticket when accepted.
Gatekeeper assessment
At installation or first launch, macOS uses its security assessment to determine what information and controls apply.
Code Signing vs macOS Notarization
Code signing establishes the signer and protects code integrity. Notarization is a separate Apple service that checks submitted software and returns a ticket when the submission is accepted.
| Code signing | Notarization |
|---|---|
| Identifies the signer | Apple checks submitted software |
| Uses a signing identity and private key | Uses Apple's notary service |
| Protects code integrity | Provides Apple's notarization assessment and ticket |
| Occurs during the signing/build workflow | Occurs after the software is prepared for submission |
| Does not replace notarization | Does not replace code signing |
Apple's current documentation says software distributed outside the Mac App Store with Developer ID should be notarized. For new Developer ID signed software and current distribution workflows, Hardened Runtime and a secure timestamp are among the notarization preparation requirements.
Developer ID Application Certificate Requirements
The practical setup starts with an Apple Developer account and the correct certificate type. The private key should be created and controlled by the party responsible for signing.
Where Is the Private Key Stored?
The certificate can be shared as part of the public identity chain, but the private key is the sensitive signing credential. Its storage model should match the release architecture.
Developer Mac
Stored in Keychain Access and used by local signing tools.
Build server
A controlled signing environment can import the identity for automated builds.
CI/CD keychain
A temporary keychain can reduce the exposure window for automated signing credentials.
Remote infrastructure
Cloud, remote or HSM backed architectures can centralize signing without distributing private keys across every build machine.
How to Create a Developer ID Certificate
Apple's current certificate workflow uses Certificates, Identifiers & Profiles and a certificate signing request. The Account Holder can create Developer ID certificates.
Open Apple Developer
Sign in with the appropriate account.
Create request
Generate a certificate signing request and private key.
Request certificate
Select Developer ID Application or Installer.
Install and test
Download the certificate, install it in Keychain and verify the identity.
Apple's documented workflow uses a .certSigningRequest file for the certificate request and provides a .cer certificate file for download.
How to Find Your macOS Signing Identity
Before automating a release, confirm which signing identities are available on the Mac and identify the exact identity that should be used by the build system.
security find-identity -v -p codesigning
What to inspect
Look for the expected Developer ID identity, team association and available certificate entry.
Why this matters
A build can fail when the certificate exists but the private key is missing, the wrong identity is selected, or the temporary keychain is not unlocked.
How to Sign a macOS Application
The standard command line workflow uses codesign. Complex applications should be signed from the inside out so nested executable code is handled before the final application bundle.
codesign --force --options runtime --timestamp --sign "Developer ID Application: Your Company" MyApp.app
Nested frameworks
Sign embedded frameworks and libraries with the intended identity before signing the outer application.
Entitlements
Pass the correct entitlement file when the application requires capabilities that must be declared during signing.
Verification
Run verification commands after signing rather than assuming a successful command means the complete bundle is ready for distribution.
How to Verify a macOS Code Signature
Verification should confirm both that the signature is structurally valid and that the expected identity and configuration are present.
codesign --verify --deep --strict --verbose=2 MyApp.app
codesign -dv --verbose=4 MyApp.app
Identifier
Confirm the bundle identifier matches the intended application.
Team identifier
Check the developer team association shown by the signature details.
Authority
Inspect the certificate authorities and Developer ID identity.
Entitlements
Review the entitlements actually embedded in the signed application.
macOS Code Signing and Entitlements
Entitlements describe capabilities and security permissions associated with signed Apple software. They are part of the signing configuration, not a replacement for signing itself.
Hardened Runtime
Enables runtime protections used by modern notarized macOS applications.
App Sandbox
Restricts access to system resources and user data for applications using sandboxing.
Keychain and other capabilities
Application features such as keychain access and push notifications can involve entitlement configuration.
An entitlement change can require the application to be signed again. A signature that was valid before the bundle or its signed configuration changes may no longer be valid after the modification.
Hardened Runtime and Code Signing
For software distributed outside the Mac App Store and submitted for notarization, Hardened Runtime is a central part of the current macOS security workflow.
Apple's notarization preparation documentation requires Hardened Runtime for relevant applications and command line targets. The capability interacts with entitlements, so developers need to test the application after enabling it and after adding exceptions required by legitimate functionality.
Build configuration
Enable Hardened Runtime in the target configuration used for the distributable build.
Testing
Test the actual release build because runtime restrictions can expose assumptions that were hidden during development.
Code Signing for DMG and PKG Distribution
A Mac application, installer package and disk image are different artifacts. Their signing and notarization considerations should therefore be handled separately.
Application
Sign the .app with Developer ID Application and ensure nested code is correctly signed.
Installer package
Sign the .pkg with Developer ID Installer when distributing a signed installer package.
DMG
Treat the disk image as a distribution container. The application inside still needs appropriate signing, and the disk image itself can participate in notarization.
macOS Code Signing for CI/CD
Automated signing is where certificate management becomes an engineering control rather than a developer workstation task. The release system should make the signing identity available only to the jobs that need it.
Build systems
GitHub Actions, GitLab CI, Jenkins and Azure DevOps can run macOS signing workflows on suitable Mac runners.
Keychain setup
Import the signing identity into a controlled keychain and unlock it only for the signing job.
Notarization automation
Use Apple's notarytool or the Notary API for scripted submission and status handling.
Do not place long lived private keys in plain CI variables. Use controlled secret storage, access restrictions, temporary keychains, protected build runners and a documented recovery process.
Cloud and Remote macOS Code Signing
Cloud and remote signing describe how the signing operation is hosted. They do not create a new Apple certificate type.
Local signing
Private key stays on a developer or build Mac.
Remote signing
A controlled service performs the signing operation away from the build workstation.
Cloud signing
Signing infrastructure is hosted as a managed service with access controls and centralized operations.
HSM based signing
Hardware backed key protection can reduce direct private key exposure in enterprise environments.
Developer ID is the Apple signing identity. Cloud, remote, HSM based and managed signing are infrastructure models for protecting and operating that identity.
macOS Code Signing Certificate Expiration
Certificate expiration affects future signing and, depending on the certificate type and software artifact, how macOS evaluates existing releases. Apple documents different behavior for applications and installer packages.
Apple states that applications signed with Developer ID can continue to run after the certificate expires when the certificate was valid when the application was compiled, subject to the other checks applied by macOS. Developer ID Installer packages have a stricter runtime requirement: an expired Developer ID Installer certificate requires the package to be re-signed with a valid certificate.
Renewal planning should therefore cover new releases, installer packages, provisioning where applicable, notarization credentials and the signing infrastructure rather than assuming one universal expiration rule.
What Happens If the Private Key Is Lost?
Losing the private key does not simply mean downloading the certificate again. The certificate and private key form the signing identity used to produce signatures.
Existing releases
Assess existing signed software separately from the ability to create new signatures.
Future releases
A replacement signing identity may be required for new builds if the original private key cannot be recovered.
Recovery
Maintain protected backups, controlled access, recovery documentation and a tested CI/CD replacement procedure.
What Happens If the Private Key Is Compromised?
A compromised signing key should be treated as a release security incident. The response must protect both the Apple account and the software distribution pipeline.
Stop signing
Disable affected release operations.
Investigate
Identify exposure and affected releases.
Revoke or replace
Work through the Apple certificate response process.
Secure
Rotate credentials and rebuild signing controls.
Respond
Assess releases and rebuild or resign where necessary.
Certificate revocation and software release response are separate considerations. The security team should also assess notarization tickets and unauthorized versions distributed with the exposed identity.
macOS Code Signing Errors
Common signing and notarization failures often indicate a mismatch between the application structure, signing identity, entitlements, keychain state or release configuration.
code object is not signed at all
Check whether the expected executable or nested component was actually signed.
a sealed resource is missing or invalid
Check whether files changed after signing or whether the application bundle contains unexpected modifications.
code signature invalid
Inspect the signature and nested code for invalid or inconsistent signing.
CSSMERR_TP_NOT_TRUSTED
Inspect the certificate chain, trust state and signing environment.
errSecInternalComponent
Check keychain access, private key availability and the signing environment.
Invalid entitlements
Compare the entitlements with the application's capabilities and distribution configuration.
Nested code not signed
Sign embedded frameworks, helpers and other executable components before signing the outer bundle.
Provisioning mismatch
Check the signing identity, team configuration and provisioning requirements for the target.
Notarization rejection
Read the Apple notary log and resolve the reported signing, runtime or packaging issue.
macOS Code Signing vs Notarization vs App Store Distribution
The distribution route determines which signing and security workflow applies. This is why a single generic certificate page cannot accurately describe every macOS distribution scenario.
| Distribution method | Signing approach | Notarization |
|---|---|---|
| Mac App Store | App Store distribution workflow | Apple's platform workflow includes its own security checks |
| Direct download | Developer ID | Use the applicable notarization workflow |
| Internal enterprise distribution | Depends on deployment model | Depends on how the software is distributed and secured |
| Developer testing | Development signing | Not normally the same production distribution workflow |
macOS Code Signing Certificate Cost
Apple uses a membership and certificate model rather than selling Developer ID certificates as individual third party CA products. The current Apple Developer Program fee is $99 per year in USD, with local currency pricing where available.
Apple Developer Program
$99/year current published US membership price.
Mac build infrastructure
Mac hardware, hosted runners or Xcode Cloud can add release costs.
Signing infrastructure
Remote, cloud or HSM based models may add service or infrastructure costs.
Operations
Security controls, monitoring, recovery and release engineering also affect total cost.
Additional costs can come from Mac build runners, CI/CD infrastructure, signing key protection, cloud or remote signing services and engineering time. Verify Apple's current membership price before publication because regional pricing and program terms can change.
macOS Code Signing for Software Companies
A production signing architecture should separate source control, build, signing, verification, notarization and distribution while limiting who can access the signing identity.
Source
Approved release code.
Build
Controlled Mac runner.
Sign
Developer ID identity.
Verify
Signature and entitlements.
Notarize
Apple notary service.
Package
DMG, ZIP or PKG.
Distribute
Controlled release.
For broader organizational controls, the existing Code Signing for Software Companies resource can sit alongside this macOS specific workflow.
macOS Code Signing Provider and Infrastructure Options
Do not compare DigiCert, Sectigo and other public CA providers as if they issue interchangeable Developer ID certificates. The correct comparison is between Apple's signing ecosystem and the infrastructure used to protect and operate the Apple signing identity.
Apple signing ecosystem
- Developer ID Application
- Developer ID Installer
- Apple Developer account
- Apple notarization service
Signing infrastructure
- Cloud HSM
- Remote signing
- Enterprise key management
- CI/CD signing infrastructure
Cloud Code Signing
Use the Cloud Code Signing resource for the infrastructure model.
Remote Code Signing
Use the Remote Code Signing resource when the signing operation is separated from the build workstation.
HSM Code Signing
Use the HSM Code Signing resource for hardware backed key protection concepts.
macOS Code Signing Checklist
Use this checklist before a production release distributed outside the Mac App Store.
macOS Code Signing Certificate FAQ
These questions target distinct commercial, technical and implementation searches around Apple's Developer ID model.
Is a macOS code signing certificate the same as a Windows code signing certificate?
No. macOS software distributed outside the Mac App Store uses Apple's Developer ID signing ecosystem, while Windows software commonly uses public CA certificates with Authenticode.
Does Apple issue Developer ID certificates?
Yes. Apple provides Developer ID Application and Developer ID Installer certificates through the Apple Developer account system.
What is a Developer ID Application certificate?
It is the Apple certificate type used to sign Mac applications and executable code for distribution outside the Mac App Store.
What is a Developer ID Installer certificate?
It is used to sign Mac Installer Packages such as .pkg files.
Do I need a certificate to sign a Mac application?
For Developer ID distribution outside the Mac App Store, you need an appropriate Developer ID signing identity and its corresponding private key.
Is notarization the same as code signing?
No. Code signing identifies the signer and protects code integrity. Notarization is Apple's separate service for checking submitted software.
Does code signing prevent Gatekeeper warnings?
A valid signature is part of the trust assessment, but signing and notarization are separate controls. Gatekeeper evaluates multiple signals when software is opened.
Can I use a code signing certificate from DigiCert or Sectigo to sign a macOS application?
A generic public CA code signing certificate should not be presented as an alternative to Apple's Developer ID Application certificate for normal Developer ID macOS distribution.
Can macOS code signing be automated in CI/CD?
Yes. Signing and notarization can be integrated into automated build pipelines using controlled Mac runners, keychain handling and Apple's command line tools or APIs.
Where should I store my macOS signing private key?
Store it in a controlled signing environment such as a protected Keychain, dedicated build environment or appropriate remote or hardware backed architecture. Avoid casual distribution of the private key.
Can I sign macOS applications from GitHub Actions?
Yes, when the workflow uses an appropriate macOS runner and securely handles the Developer ID signing identity and private key.
What happens when a Developer ID certificate expires?
Apple documents different behavior for applications and installer packages. An application signed while the Developer ID certificate was valid can continue to run after expiration, while an installer package signed with an expired Developer ID Installer certificate must be re-signed.
What happens if my macOS signing certificate is revoked?
Apple states that a revoked Developer ID application can no longer be installed or launched. The incident should also trigger an investigation of affected releases and signing credentials.
How do I verify a macOS application signature?
Use codesign verification commands and inspect the signature details, identifier, team identifier, authority and entitlements.
Related Resources
Connect the macOS page to the wider CodeSigningSolution resource architecture without treating every code signing technology as interchangeable.
Platform
This page covers the macOS Code Signing Certificate use case, while the macOS Code Signing Guide focuses on the wider platform workflow.
How To
For the practical release process, follow How to Sign macOS Applications and use the code signature verification steps to check the signed artifact.
Infrastructure
Teams protecting signing credentials across release environments can compare cloud code signing, remote code signing and HSM code signing.
Business
Signing requirements vary by release process, so review code signing for software companies or code signing for independent developers for different team contexts.
Concepts
Understand the trust model through how code signing works, the code signing certificate chain and code signing and timestamping.
Troubleshooting
When a release fails verification because of signing credentials, review what happens if a code signing private key is compromised and revisit the signature verification process before distributing a rebuilt artifact.
Build a secure macOS signing workflow
For macOS software distributed outside the Mac App Store, start with the Apple Developer ID model, then design the signing, verification, notarization and key protection workflow around the actual release artifacts.