Original Apple Developer ID Sub-CA expires: affected .pkg installers stop installing

macOS

Who is affected

Mac admins who deploy installer packages signed with a Developer ID certificate issued by the original Sub-CA, including in-house packages and older third-party packages in Intune, Jamf or other MDM. Notarised apps with a secure timestamp keep working.

What to do

1. Run pkgutil --check-signature on every .pkg you deploy and note which ones chain to the original Developer ID Certification Authority.
2. Re-sign in-house packages with a certificate from Developer ID Certification Authority (G2) and re-upload them.
3. Ask vendors for re-signed packages and replace cached copies in your MDM before February 1, 2027.

Source

“The original Developer ID Certification Authority (Sub-CA) expires on February 1, 2027. Certificates issued by this authority will stop working on that date.”

“Installer packages (.pkg): Starting February 1, 2027, .pkg files signed with an affected certificate will no longer install.”

On KBY:Intune vs Jamf for Mac management

Checked 9 Nov 2026 Link to this deadline