I did not save Private Keys. I lost Mac profile and had to reset my Mac Machine. So after this, my Developer ID certs are not working and my account reached limit of certificates. Now only left option for me is to delete or Revoke Developer ID certs. Apple support replied to my email saying that they can't revoke and approach Apple forums for help. Please advise. Since from 3 weeks, I have been struggling to get this resolved. Thanks, Anand

We have an application written in C and C++ that runs on Windows, Linux, and Mac. Recently a customer trying to install it on macOS Monterey received a message saying "cannot be opened because it is from an unidentified developer". To deal with this my company has joined the Apple Developer Program. So my question is how do we make use of that membership to get past this problem? Of the three platforms mentioned above, Mac accounts for the fewest customers, so we're not Mac experts. The software is built using Xcode but with makefiles that directly invoke clang or clang++. The finished product is packaged into a .dmg file. Note that we're not intending to put this software into the App Store.

Hi. I'm in the process of making changes to a MacOS SwiftUI project in order to have it be deployed using Developer ID. The project is a VPN using a packet tunnel provider so I'm converting the NetworkExtension to the SystemExtension equivalent. I run the exported app from the Applications folder and it starts up fine but I get a log saying that the current bundle does not have a SystemExtensions directory. When I check the contents of the package, it has put the extension in the Plugins folder instead, which tells me that the extension is still being treated as an app extension rather than a system extension. When I try to run the extension from my app, I get a log saying "Provider is an app extension and therefore cannot be signed with a Developer ID certificate" I have followed all steps listed here: https://developer.apple.com/forums/thread/125508 I have packet-tunnel-provider-systemextension in the Network Extensions array in the entitlements for both the main app and the extension. I've got Network Extension entitlements on both identifiers and and System Extension on the main app identifier I've created and imported provisioning profiles for both. No errors on either. In the extension's info.plist, I have made sure to set the bundle type to SYSX The product name for my extension matches it's bundle identifier The extension's wrapper extension is systemextension Can anyone think of anything I have missed which would cause Xcode to continue packaging it as an appex rather than a sysex? Or is there possibly somehow something I need to change in the swift code which Xcode will pick up on when packaging? Let me know if you need more info from me. Thanks in advance

I send a Requesting a Developer ID Certificate for Signing Kexts. But there was no response in the past two months. How can I know the progress?

The issue around CERTIFICATES and their RANDOM REVOCATION is one that I just can’t get my head around, as hard as I may try. I’ve read “Certificate Signing Requests Explained” and most others that one would consider relevant and I’d like to say “I get it” except…I don’t. At least not well enough to prevent what I’m encountering. I have a developer account (at the moment it needs to be renewed) and a dev team (me) that lets me do whatever in Xcode. I’ve compiled several apps for macOS, each of which runs fine, for a time. Then, after a random interval of days or sometimes weeks I get the DREADED EMAIL from Apple that reads: "Your Certificate Has Been Revoked. You have revoked your certificate, so it is no longer valid", and they don’t! Any attempt to start them generates the warning "[This App] will damage your computer. You should move it to the Trash." Each needs to be recompiled with what is apparently a valid certificate courtesy of Xcode to get them to run again, which they do, until the next email from Apple shows up and they don’t. Let me stipulate that I have done nothing overtly to revoke these certificates (6 revocations since April 22) nor have I done anything but use Xcode to automatically manage the creation of new ones. So the ask: what I do I need to do to keep this from happening? PS: I have read numerous places to ignore these emails which I have done without consequence. Only now after I am using several apps that I've created has this become problem.

I have an application for macOS that uses core data to save data. I switched to CloudKit so I can sync that data with its iOS counterpart. This is on Xcode 13.4. Even since I did that I get the error: When I try to submit it for a distribution with "Developer ID" I have been going in circles for the last two days. I have tried all the stuff several articles here at SO mentioned (e.g. this one), or the Apple Dev Forums (for example this one). I have tried deleting certs, regenerating them, adding them again, downloading "manual profiles" again, going to the building settings and changing certs and options... It doesn't matter. It goes nowhere. Here's the thing, if I go back to the version without iCloud, all is good. Same with any iOS app that uses iCloud. All builds, and all goes to Apple without any issues. It's only this app. For the sake of testing I created a new macOS app, and from the get go I enabled CloudKit. Same error. So, what's missing? Is there any special foo or incantation I need to utter to get an macOS app to use iCloud and be able to be distributed? Thanks

Our product is distributed as a Mac installer package, and it is only distributed by us, not via the Mac App store. Thus, we have Developer ID certificates to sign both the actual software components within the installer package (Developer ID Application With KEXT - since we have a KEXT), and the installer package itself (Developer ID Installer). Our Developer ID certificates are set to expire next month, so we just created new ones which we are switching to. However, we also maintain an archive of older product installer packages on our website for users that need to run earlier releases for some reason (running on older OS, etc). It sounds like we may need to re-sign those older installers with the new Developer ID Installer cert, as the info here makes it sound like those installers will no longer run after the cert expires: https://developer.apple.com/support/certificates/ https://developer.apple.com/support/developer-id/ We’re trying to get a definitive answer on what we need to do, before it’s too late to do it, but some of the behavior of this certificate stuff is a little confusing (also, I did file a DTS request to get clarification on this, and ultimately they referred me to posting here on the dev forums). Let’s assume all those older installers were signed with our old Developer ID Installer cert, and let’s say that cert expires on 6/1/22. My questions are: 1 ) I assume those installers will now cease to run after 6/1/22, correct? But any installs that ALREADY happened with those installers will continue to work after 6/1/22? This is what the links above suggest, but we specifically want to make sure this is the case for the KEXT, which in those older installers is signed with the older Developer ID Application With KEXT cert which also expires on 6/1/22. [Related question, is there any reliable way to test this? I assume it would be more complicated than just setting the system date on a test machine past 6/1/22…] 2 ) Assuming it is the case that those old installers will no longer run after 6/1/22, do we just need to re-sign those installer packages with our new Developer ID Installer cert? OR, do we additionally need to re-NOTARIZE the installer packages (assuming they need to run on Catalina or later)? [Logically it seems like we need to re-notarize after re-signing, and one test seemed to confirm that, while another similar test done by another developer had different results. I think what happened there was that the developer re-signed the installer with the new cert and saved that off (testA.pkg), then uploaded that installer to the notarization service and saved the result w/stapled ticket as a differently named file (testB.pkg). We figured that when running the “only re-signed" installer (testA.pkg), we would get the gatekeeper error, but we didn’t (also spctl reported it as passing notarization). I assume this is because the same binary installer had already been uploaded for notarization, and something in the OS was able to talk to the notary service and detect that this installer (testA.pkg) was the same as the one that had been uploaded for notarization, hence reporting it passed. I guess that is why the note here about testing notarization mentions testing with network connectivity disabled: https://developer.apple.com/forums/thread/130560] 3 ) Assuming we do need to re-notarize the old installers, do we need to do that before the cert that was used to sign the software components within them expires on 6/1/22? I.e. will the process of notarizing a .pkg look inside the package for executable code bundles, and then fail if a bundle was signed with a now-expired cert? For various reasons it would be difficult to break apart these old installers, re-sign their individual software components with the new Developer ID Application cert, and re-package them. Thanks for any insight!

Hi everybody. I got stuck with the problem. I want to use "Sign in with Apple" capability in application signed with Developer ID certificate. I enable this entitlement in my App Store Connect for my App ID, generate the provision profile, download it in Xcode but it writes me that my provision profile does not support "Sign In with Apple" capability. Please clarify my anybody, is it possible to use "Sign in with Apple" capability in applications signed with Developer ID certificate?

After uploading a new App to the App Store Connect i receive an e-mail stating:ITMS-90034: Missing or invalid signature - The bundle '...' at bundle path 'Payload/...' is not signed using an Apple submission certificate.The App don't use any capability.I've used Xcode to upload, as in a previous App which now is on the App Store.All the apps use the default configuration: "Automatically manage signing", Provisioning profile "Xcode Managed Profile", Signing Certificate Apple Development: ############The requested Signing Certificate is present in the keychain in 3 versions, the last one is valid (the older 2 are revoked).What I should correct?

Created two requests and got certificates, Developer ID Application and Developer ID Installer and now the country in the subject field is "US" instead of "FI" that was in the requests. The previous certificates had country correctly set to "FI".Is there any place I can affect to get the country right in the certificates as the process does no obey the request in this respect? Our country info is unchanged and correct in our Apple dev account.Or, does Apple give a possibility to reissue (or something else) a certificate, changing the country?

Dear apple developer community... I am facing the problem on creating my own pushPacakge and .p12 webpush certificates file for safari push notifications. I follow all steps carefully on an official document here with my team. And also try to follow some tutorials on some blogs which corresponding to its. But it still doesn't work. Here's how my problem looks like I've got .p12 file then I've test to upload it into some push service like oneSignal, truePush and etc. It's able to upload the file but the push service still doesn't work. But if I used a provided .p12 from their service, the notification will working properly. I try to use my .p12 to generate a push package (pushPackage.zip). But the api log on my webServiceUrl keep showing me "{ logs: ['Signature verification of push package failed'] }". Even if I try all versions of AppleWWDRC (G1-G6) downloaded from here. And even I use an official php script (createPushPackage.php) file from apple apn document downloaded from here on the top right corner at companion file Here's what I've done so far to get my own .p12 file... Generate my own CSR file from mac keychain application Noted1: My appleId on my mac is an Admin role only on apple developer account (Not a Admin, Account Holder role) Noted2: I've try to enter an apple id with role Admin, Account Holder on a User Email Address field but it still doesn't work Login into an apple developer account console on apple developer site Go to identifier tab and create new webPushId identifier Enter description and webPushId(reverse domain name style which is web.com.herokuapp.kkwebpush) Come back to certificates tab and create new certificate (select webPushId radio button and click create) Choose webPushId that already created on step 4 from dropdown list then click on continue Upload CSR file that generated on step 1 into its Download .cer file Click on the downloaded .cer file from step 9 and generate .p12 file by keychain Here's how I create pushPackage.zip file Create folder to store all files needed ( reference from here ) which are AppleWWDRCA.cer Certificates.p12 (Generated from step 9 above) createPuchPackage.php (Official script from apple which already edit the path to Certificates.p12 and enter private key match with my Certificates.p12 password) intermediate.pem (Generated from export AppleWWDRCA.cer on keychain as intermediate.pem) pushPackage.raw (folder that contain both icon.iconset and website.json that already set matched webPushId and webServiceUrl inside website.json) So, the folder structure now look like this Then I start to run php createPushPackage.php inside this folder. After that I've got an unreadable format result on my terminal .But I still get a pushPackage.zip file stored at /tmp folder (At this point I think it might be fine with that unreadable format) . Head over to my tmp folder to move that pushPackage.zip file into my webServiceUrl endpoint directory for send a pushPackage when apple api model was called on window.safari.pushNotification.requestPermission ( Already set these 4 parameters below) url as my web service url to my endpoint websitePushID as my web site id registered on apple developer console userInfo as empty object {} callback as function as a callback function FINALLY MY FINAL QUESTIONS ARE... Are there any steps that I've missed? Why I keep getting { logs: ['Signature verification of push package failed'] } on my web service url log errors endpoint? Does my certificate is invalid? (If yes, what are all possible causes) Why I can't use my own .p12 file on other push services (oneSignal, truePush and etc.) that support custom upload .p12 file for safari push notification? * When I used a provided .p12 from their service, everything works fine (safari permission popup can appear). On the other hands, If I use my own .p12, I can upload its to their services but safari permission popup don't show up)? Any solution please? Thanks

During build process, I have been encountering an error "error: The specified item could not be found in the keychain." for the code signing process. My apple ID joins a developer program of my company. I have 2 macbook - 1 for my personal, and 1 for my company. I can build apps with my personal macbook, but failed with my company one. I have exported the developer account from xcode of my personal macbook, and also imported to the company macbook's xcode. Both macbooks are macOS Monterey, and both xcode are the same version 13.2.1 For building an app, I've chosen "Automatically manage signing"

Hi, I'm a font designer and making pkg installers for my fonts. Before, I was using Hancock app to code sign my pkg files easily though using my old MBPro (15inch- mid2014). Now almost a month ago, I bought a new MacBook Pro (16-inch, 2019) and renew my subscription to Apple Developper program, when I downloaded my .cer file from "Certificates, Identifiers & Profiles" then import my .cer file through Keychain Access, It get loaded ok but it does not show on "My Certificates" even it's there at "Login" level. So Hancock app won't find it except if it's under "My Certificates" level... and I'm lost, I struggle to copy paste again to "My Certificates" but no way.... Thank you very much in advance for your kind help. Here is my website:  https://norfonts.ma  I'm also selling my fonts through NC :  https://www.notationcentral.com Thanks for you kind help, —Nor Eddine Bahha (Jazz Piani st & Font Designer)

I am currently working with XCode 13.3.1 on OSX Monterey 12.3.1 on a Mac Mini M1. I have written some programs in Swift for personal use using a personal team certificate. I haven't paid the $99. Every couple of weeks or so, some of my programs will pop up a message saying "This Program Could Harm Your Mac" and won't let me run it when I try to launch them. It seems I have to recompile it and then it will work for a few more weeks. Other programs have run for several months. The programs are using Sandbox and Hardened runtime. Someone suggested that I try compiling the program without a certificate. I did that last night and the program ran. But this morning when I launched the program, I got a message that the program had unexpectedly quit. The "report" message said something about a code signature. FWIW, I am copying the program to my Applications folder.

When opening a pkg file on Mojave and Catalina I'm seeing following Package Authoring Errors in Installer log (/var/log/install.log):Package Authoring Error: <background> has an unsupported MIME type: image/data Package Authoring Error: <background_scaling> has an unsupported MIME type: X-NSObject/NSNumber Package Authoring Error: <background_alignment> has an unsupported MIME type: X-NSObject/NSNumber Package Authoring Error: <layout-direction> has an unsupported MIME type: X-NSObject/NSNumberwhich is weird because background is defined in pkg Distribution XML as:<background file="background.tiff" alignment="bottomleft" scaling="none" mime-type="image/tiff"/>based on specification of Distribution file in https://developer.apple.com/library/archive/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.htmlSimilar problems can be seen even on pkg installers that contain no background XML element. That also includes pkg files downloaded from Apple website.Is there any explanation where these errors are coming from?

I have a framework that I am trying to embed in an application.The framework uses cmake to build itself, and I can rebuild as needed to fix this problem.When I include the library in my application, with Code Sign On Copy checked, the step fails with a file not found. Tracing the output, it is trying to sign a library at Versions/A. The library should have a version of 1.10.0, and when doing otool it reports the version numbers as 1.10.0.So, where does xcode get that A for the version when trying to sign the library? What can be changed so it has the right version number?

In one of the applications that I develop, since version 9.3 of Xcode, an embedded target binary that is launched from the main application using NSTask now fails to launch with the following error message:Sandbox: [AppName(App PID)] deny(1) forbidden-sandbox-reinitI couldn't find much information about it and it's not clear what change happened in Xcode 9.3 (also happens in 9.4 beta 1) that causes this to fail.

i have a mac app,like simpholders app,to find and manager simulator's sandbox and gouse NSTask exe command:/usr/bin/xcrunwill show errorxcrun: error: cannot be used within an App Sandbox.

Hi, Created new "Dev ID Application" certificate and it shows in my local Keychain where I created CSR as "Certificate is not trusted". I also see some Push Notification certs created recently have the same warning. Items tried. Installed new Intermedate certs as recommended in post https://developer.apple.com/forums/thread/672933 :- WDRCA-G3 expiring 20-Feb 2030 installed on (Login -> Certifcate) WDRCA expiring 7-Feb 2023 installed on (Login -> Certifcate) Deleted and reinstalled both of the above WDRCA certs Restarted Keychain & Mac several times. The same warning is seen on each of Mac nodes that I have installed the new certs on. Does anyone know how to resolve or have any suggestions on how I can debug this problem.

Hi all, I'm attempting to distribute a notarized expiring demo variant of my Mac App Store app (TypeMetal) directly to potential customers as a download on our website, using the procedure documented here: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution I successfully complete the 9 steps listed in "Notarize Your App Automatically as Part of the Distribution Process", including choosing "Developer ID (Distribute directly to customers)" and "Upload (Send to Apple notary service)", and successfully download the resultant .app bundle, but I'm unable to run the app. It looks to me as if the system is attempting to obtain an App Store receipt for the app, when what I want is for this variant of the app to be treated as distinct from the purchased Mac App Store version, and be runnable without purchase. I have tried changing the app's bundle identifier and removing the LSApplicationCategoryType (in the Xcode target's settings, before building), but neither seems to affect these results. I'm left wondering how the system is determining that this is an .app that requires App Store sign-in/receipt-checking. When I copy the downloaded, notarized .app to a different macOS user account, log in as that user, and attempt to launch it there, the system presents a panel, prompting for the user to sign in with their Apple ID: When I attempt to launch the app in my own user account (the one I build and develop in), the system presents the same prompt in a slightly different form: Whether or not I provide a valid Apple ID sign-in in either case, the launched app then terminates with a fatal alert. (Same result in a separate user account as in my own development account.) I would like for the distributed app to be runnable by customers without requiring an App Store receipt. I have verified that my own App Store receipt-checking code is being omitted, as I intend, from the build I that submit for notarization. Is there something I need to do differently to make this work? The notarized app has passed the checks described here: Resolving Common Notarization Issues https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721 I can provide the outputs of the codesign and spctl checks recommended on that page, if that would be helpful. The .app contains one embedded framework (OpenSSL.framework) and one command-line executable (tidy), but I believe they are correctly code-signed. I'm testing this on a 2020 M1 MacBook Air running macOS 12.3.1 (21E258), using Xcode 13.3.1 (13E500a) to do the build, upload for notarization, and export of the notarized result. Thanks very much in advance for any insight you can offer. Troy Stephens Coherence Labs, LLC