Haven’t seen it mentioned here yet, so I thought I’d give a heads-up as I’ve been pretty surprised by it and I’m still amazed how bonkers the situation is.
Y’all probably got an email from Apple about it a few weeks ago (I kinda overlooked it actually as I did the regular re-issuing a week earlier and thought my certs are as current as can be). So the thing is that the “old” “G1” certificate authority Apple uses (still by default as of today) to issue developer certificates expires on Feb 2 2027, which isn’t that long away. Most signatures aren’t affected, apps etc. will continue to work as long as it’s been signed and timestamped while the certificate is valid.
However, according to Apple that’s not true for .pkg installers, and these will refuse to install after the G1 authority expires. So you need to get a new “G2” certificate and re-sign any .pkg installers you distribute. No need to rebuild anything, but you should sign with a new certificate.
Now here’s the crazy part: Xcode (at least until 26.6, which isn’t exactly old) by default still issues G1 certificates when you use its certificate tool, with no option to choose G2 instead. You have to go through the developer portal and jump through the extra hoops (generate CSR file, issue certificate, download, import to keychain). And even there as of today G1 is selected by default, and the wording offers no hint at all that a G2 one is clearly what you want these days because the default one will silently make your installers useless in a few months. So even if you got fresh certificates yesterday (or this morning), chances are you may want to re-do the whole exercise without mindlessly clicking through the defaults because you’re sleepy and/or maybe slightly drunk.
I expect this matter to bite a whole lot of companies in the foot next February and create an army of angry customers. So better be prepared and re-sign your installers sooner rather than later.
Interestingly, installing pkgs with expired certs is no problem as long as they’re timestamped. But it seems the authority expiring is a problem.