Apple's developer news, dated October 1, 2026, sets a firm date: the original Developer ID Certification Authority, the intermediate Sub-CA used to sign Mac apps distributed outside the App Store, expires February 1, 2027. Certificates it issued stop working that day. Apple names a replacement, Developer ID Certification Authority (G2), but the announcement does not say whether existing signed binaries will fail Gatekeeper checks retroactively or only block new signing operations after expiration.
This matters for anyone running automated build and release pipelines for macOS software, including CI runners, installer packagers, and notarization steps tied to a specific signing identity. A Sub-CA expiration is not a routine cert rotation on a server; it is upstream of every Developer ID certificate that chains to it, meaning a fleet of signing certificates could lapse simultaneously rather than on staggered renewal schedules teams are used to tracking. Sixteen months is the runway from this announcement to the deadline, which sounds generous until a team realizes signing infrastructure is often untouched for years at a stretch.
Confirmed, from Apple: the expiration date, the name of the old Sub-CA, and the name of its replacement, G2. Not confirmed: migration mechanics, whether re-signing is required for already-shipped binaries, whether notarization servers will reject old-chain signatures before February 1 or only after, and whether Apple will auto-issue G2 certificates or require manual re-enrollment through the developer portal. Anything beyond those four confirmed points is inference, not disclosure.
On-call engineers should treat this as a dependency audit, not a patch. Check which build machines hold Developer ID Application and Developer ID Installer certificates, trace which Sub-CA each one chains to, and confirm whether CI secrets stores reference certificate identities that will need replacement rather than renewal. Pipelines that hardcode a certificate SHA or keychain reference, instead of looking up the current valid identity, are the likely failure mode. A silent break here looks like notarization rejecting a build at 2 a.m. with no code change to explain it.
The open question is blast radius. If Gatekeeper enforcement only applies to newly signed code after February 1, existing installed software keeps running and the fix is a signing pipeline update before that date. If enforcement extends to verification of already-distributed binaries, support queues could see a spike in Gatekeeper rejection reports from end users with no corresponding release on the vendor side. Apple's announcement does not resolve this distinction, and no changelog or technical note accompanying the Sub-CA news addresses enforcement timing beyond the expiration date itself.
Platform teams shipping macOS software have until February 1, 2027, to confirm their signing chain resolves to Developer ID Certification Authority (G2), not the one expiring that day.