Observed Signal · Oct 1, 2026 · Policy Update · Source: Apple Developer News · Impact: 1/5 · Sentiment: Neutral
Apple Developer ID Certificate Authority Expires February 2027
Apple has announced that the original Developer ID Certification Authority (Sub-CA) will expire on February 1, 2027. Certificates issued by this authority will stop working on that date. Developers are advised to check their certificates for expiration on or before this date, create new certificates from the current authority (G2), and re-sign any installer packages (.pkg) that might be affected. Mac apps signed and notarized with a secure timestamp will continue to work without action, but future updates must use the new certificate. This affects developers distributing software outside the Mac App Store, including those using ad-supported models or other distribution methods.
This is a technical update for Apple developers that may affect the distribution of Mac apps, but it has limited direct impact on the broader AdTech ecosystem.
Track Apple Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- The original Developer ID Certification Authority (Sub-CA) expires on February 1, 2027.
- Certificates issued by this authority will stop working on that date.
- Developers must create new certificates from the current authority (G2) to continue distribution.
- Installer packages (.pkg) signed with affected certificates will no longer install after February 1, 2027.
- Mac apps signed and notarized with a secure timestamp will continue to work without action.
Connected Companies & Entities
1 Entity mapped“Apple has announced the upcoming expiration of the Developer ID Certification Authority (Sub-CA)....”
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
OpenAI rotates macOS signing certificate after Axios compromise
On April 10, 2026 OpenAI disclosed a security incident tied to a compromised third-party developer library, Axios, that was part of a broader supply-chain attack. On March 31, 2026 a GitHub Actions workflow used in OpenAI’s macOS app‑signing process downloaded and executed a malicious Axios package (v1.14.1) and had access to code‑signing and notarization material. OpenAI found no evidence of user-data access, system compromise, or altered published software, but is treating the signing certificate as compromised: it engaged third‑party forensics, rotated and will revoke the certificate, published new macOS builds, and is asking macOS users to update apps by May 8, 2026 to avoid blocked launches. The root cause was a GitHub Actions misconfiguration (floating tag and missing minimumReleaseAge).
Apple Mandates New Notifications for Korean App Developers
On October 9, 2025, Apple announced a new requirement effective January 1, 2026: developers based in the Republic of Korea must provide a server-to-server notification endpoint when registering or updating a Services ID that associates their website with an app using Sign in with Apple. The endpoint enables Apple to send notifications about user account status changes — for example, email forwarding preference changes, account deletions within an app, and permanent Apple Account deletions. Apple advises developers to immediately apply these notifications to app and server data, follow guidance on handling account changes (including TN3194), and comply with applicable legal requirements. Resources referenced include WWDC20 session 10173 and App Review/Human Interface Guidelines.
Apple Mandates New Notification System for Korean Developers
Apple announced on October 9, 2025 that starting January 1, 2026, developers based in the Republic of Korea must provide a server-to-server notification endpoint when registering a new Services ID or updating an existing Services ID to associate their website with an app using Sign in with Apple. The notification endpoint enables Apple to send updates about user account status, including changes in email forwarding preferences, account deletions in an app, and permanent Apple Account deletions. Apple advises developers to promptly update app data and server infrastructure upon receiving notifications, to follow guidance in WWDC20 session 10173 and TN3194, and to comply with applicable legal requirements for storing, retaining, and handling user account information. Additional resources include the App Review Guidelines and Human Interface Guidelines.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.