Expiring Developer Certificates Causing Some Mac Apps to Refuse to Launch

A number of Mac apps failed to launch for users over the weekend because of a change to the way Apple certifies apps that have not been bought directly from the Mac App Store.

Several users of apps including Soulver and PDFPen who had downloaded the apps from the developers' websites all reported immediate crashes on launch. Developers of the apps quickly apologized and said that the issue was down to the apps' code signing certificates reaching their expiration date.

Apple issues developer signing certificates to assure users that an app they have downloaded outside of the Mac App Store is legitimate, comes from a known source, and hasn't been modified since it was last signed. In the past, the expiration of a code signing certificate had no effect on already shipped software, but that changed last year, when Apple began requiring apps to carry something called a provisioning profile.

provisioning profile app error
A provisioning profile tells macOS that the app has been checked by Apple against an online database and is allowed to perform certain system actions or "entitlements". However, the profile is also signed using the developer's code signing certificate, and when the certificate expires, the provisioning profile becomes invalid.

Victims of expired provisioning profiles over the weekend included users of 1Password for Mac who had bought the app from the developer's website. AgileBits explained on Sunday that affected users would need to manually update to the latest version (6.5.5), noting that those who downloaded 1Password from the Mac App Store were unaffected. The developers' surprise was explained in a blog post:

We knew our developer certificate was going to expire on Saturday, but thought nothing of it because we believed those were only necessary when publishing a new version. Apparently that's not the case. In reality it had the unexpected side effect of causing macOS to refuse to launch 1Password properly.

Currently, the common factor among affected apps appears to be those that were issued iCloud entitlements as part of their provisioning profile. Smile, developers of PDFpen and PDFpenPro, told TidBITS that users would need to manually download the latest updates to the apps to fix the problem.

Acqualia, developers of number-crunching app Soulver, also apologized for the problem and asked affected users to download an update to fix the issue.

As the above suggests, the immediate solution for developers with potentially affected apps is to renew their code signing certificates before they expire. AgileBits said the incident had given them "a new understanding of the importance of expiring provisioning profiles and certificates" and would be renewing its current certificate, due to expire in 2022, "far before then".

Top Rated Comments

MagnusVonMagnum Avatar
61 months ago
Very, very poor show from the developers. No excuse for their laziness/lack of awareness.
That's got to be the saddest reply I've seen this year. Go blame the developers for Apple's BULLCRAP NONSENSE. :rolleyes:

Software you have already installed and was already validated should NEVER STOP WORKING. PERIOD. There is NO EXCUSE for what Apple did as this will invalidate any software that authors stop updating.

What happens if an author dies or stops developing Mac software? Your older software should just stop working? What a load of crap and even more so for someone defending Apple.

As far as I'm concerned it's just another reason NOT to upgrade to Sierra. Apple is doing its damn best to screw the pooch for everyone when it comes to open software development. They clearly want the tools in place to invalidate your entire software library at the push of a button like they can already do on iOS devices and slowly keep heading in that direction with every Mac OS update.

Lets not forget last year's BS where Apple forgot to renew THEIR OWN certificates which caused total HAVOC with App Store Applications! My god was that a fracking mess! And did Apple do anything to make up for it? Yeah, they made Sierra even more bonkers nuts. Great job Apple. INFERIOR products is sadly becoming par for the course with Apple. (Wasn't that just a week ago I ready about black paint chipping off brand new iPhones?) :confused:
Score: 46 Votes (Like | Disagree)
Fuzzi Avatar
61 months ago
Amateur hour. Devs are happy to bemoan Apple taking their 30% - but can't even be bothered to sort this out?
The Apple documentation says


* Developer ID Application Certificate and Developer ID Installer Certificate (Mac applications)
If your certificate expires, users can still download, install, and run versions of your Mac applications that were signed with this certificate. However, you will need a new certificate to sign updates and new applications. If your certificate has been revoked, users will no longer be able to install applications that have been signed with this certificate.

https://developer.apple.com/support/certificates/

I think this is definitely an Apple bug. Developers were just relying on the information given by Apple, which turned out to be false.
Score: 11 Votes (Like | Disagree)
Fuzzi Avatar
61 months ago
N
"We knew our developer certificate was going to expire on Saturday, but thought nothing of it because we believed those were only necessary when publishing a new version."

Seems to me Apple was very clear, while the developer in this care decided not only to ignore it, but to admit it....
no, the developers didn't think anything of it because Apples documentation clearly states that the apps will continue to work.

https://developer.apple.com/support/certificates/
Score: 5 Votes (Like | Disagree)
theluggage Avatar
61 months ago
I was pointing out if the developer or company walks away from the app (or dies), then that app may very well stop working due to other circumstances like OS updates.
Yes, even without this certificate issue, an abandoned app may stop working. Or it may not - responsible OS developers don't introduce app-breaking changes lightly, and you can always choose to hold off major OS updates for a year or two until you've found a new solution.

With this issue, an abandoned app will stop working when the certificate expires. Like clockwork (you don't know when D-day is, so it will come without warning for you, but it is pre-ordained) For a totally avoidable (and, in this case, apparently undocumented) reason. Even if you don't upgrade the OS.

The certificate needs to have been valid when the app was signed. There's absolutely no security reason to do more than pop up a warning if it has expired (as opposed to revoked) when the app is run.

This is either a bug or a prime example of "defective by design".
Score: 4 Votes (Like | Disagree)
gnasher729 Avatar
61 months ago
The page you linked clearly talks ONLY about MAS apps....and MAS purchases were not affected...don't see your point.

EDIT:
If your certificate has been revoked, users will no longer be able to install applications that have been signed with this certificate.

An expired certificate is..."revoked"
Wrong, wrong, wrong. Expired and Revoked are completely different things. "Expired" means "this is a perfectly fine certificate and always was, but unfortunately it is now out of date". "Revoked" means "this is a highly dodgy certificate that should have never been trusted in the first place. Unfortunately we only found out just now. So don't trust anything signed with this certificate".
Score: 4 Votes (Like | Disagree)
gnasher729 Avatar
61 months ago
Expired certificate is no longer trusted. Revoked certificate is no longer trusted, although it did not expire yet. In terms of certificate management, both lead to the same status: cert is not trusted. Hence the described issue.
Completely different. Expired certificate was trusted. It was used to verify the app, therefore the app can be trusted. Expiration doesn't matter: The app was verified with a trusted certificate, so it can be trusted, 100 years after expiration of the certificate.

A revoked certificate has just been found out to be untrustworthy. It should never have been trusted in the first place. The app was verified with a certificate that should never have been trusted, therefore the app cannot be trusted.

It's like the difference between a child minder who let his certification slip, and a child minder who you just found is a multiple child killer. You don't trust either, but there is just that tiny little difference... And of course if you had been using a child minder for a year and his certification runs out, it's still the same person so you can trust them just as much as the day before.
Score: 3 Votes (Like | Disagree)

Related Stories

General Apps Messages

Android iMessage Competitor Puts Pressure on Apple

Friday July 30, 2021 3:15 am PDT by
Google and the three major U.S. carriers, including Verizon, AT&T, and T-Mobile, will all support a new communications protocol on Android smartphones starting in 2022, a move that puts pressure on Apple to adopt a new cross-platform messaging standard and may present a challenge to iMessage. Verizon recently announced that it is planning to adopt Messages by Google as its default messaging...
iphone 13 teal with text

Apple Begins Preparation for iPhone 13 Production Ahead of Fall Launch

Monday June 28, 2021 3:29 am PDT by
We're just a few months away from when Apple is expected to reveal the 2021 iPhone, dubbed the "iPhone 13." In preparation for its launch, it has been pulling in shipments of different components needed to produce the new iPhones, according to a report from DigiTimes. In years past, Apple released its latest iPhone lineup, alongside a new Apple Watch, during a September event at Apple Park....
studio buds family

Beats Studio Buds Debuting Today With Active Noise Cancellation, Stemless Design, and More for $150

Monday June 14, 2021 8:00 am PDT by
We've seen a lot of teasers about the Beats Studio Buds over the past month since they first showed up in Apple's beta software updates, and today they're finally official. The Beats Studio Buds are available to order today in red, white, and black ahead of a June 24 ship date, and they're priced at $149.99. The Studio Buds are the first Beats-branded earbuds to truly compete with AirPods...
bluetti eb70 main

MacRumors Giveaway: Win a Bluetti EB70 Portable Power Station and 200W Solar Panel

Friday September 3, 2021 11:13 am PDT by
For this week's giveaway, we've teamed up with MAXOAK to offer MacRumors readers a chance to win a Bluetti portable power station and an accompanying solar panel. Bluetti makes a range of portable power station options that are useful for camping, emergencies, power outages, off-grid living, and similar situations. The Bluetti EB70 is a solid middle of the road option that offers 716Wh and...
apple privacy

Apple Publishes FAQ to Address Concerns About CSAM Detection and Messages Scanning

Monday August 9, 2021 1:50 am PDT by
Apple has published a FAQ titled "Expanded Protections for Children" which aims to allay users' privacy concerns about the new CSAM detection in iCloud Photos and communication safety for Messages features that the company announced last week. "Since we announced these features, many stakeholders including privacy organizations and child safety organizations have expressed their support of...
macos catalina legacy system extension alert

Apple Begins Warning Users That 'Legacy System Extensions' Won't Work With a Future Version of macOS

Wednesday March 25, 2020 9:53 am PDT by
Apple has shared a new support document that indicates kernel extensions — which it calls "legacy system extensions" — will not be compatible with a future version of macOS because they "aren't as secure or reliable as modern alternatives."System extensions are a category of software that works in the background to extend the functionality of your Mac. Some apps install kernel extensions, which...
General Spotify Feature

Spotify Pauses Plans to Add AirPlay 2 Support to iOS App [Update: Spotify Clarifies]

Friday August 6, 2021 9:07 am PDT by
See update at bottom of article Spotify this week confirmed that its plans to add AirPlay 2 support to its iOS app have been placed on indefinite hiatus. In an online discussion forum post, a Spotify representative said the streaming music service had been working on supporting AirPlay 2, but the company has paused the efforts "for now" due to "audio driver compatibility issues." The...
youtube apple tv

YouTube Discontinuing 3rd-Generation Apple TV App, AirPlay Still Available

Wednesday February 3, 2021 3:09 pm PST by
YouTube is planning to stop supporting its YouTube app on the third-generation Apple TV models, where YouTube has long been available as a channel option. A 9to5Mac reader received a message about the upcoming app discontinuation, which is set to take place in March.Starting early March, the YouTube app will no longer be available on Apple TV (3rd generation). You can still watch YouTube on...
os x mountain lion macs 16x9 2

Apple Makes OS X Lion and Mountain Lion Free to Download

Wednesday June 30, 2021 12:19 pm PDT by
Apple recently dropped the $19.99 fee for OS X Lion and Mountain Lion, making the older Mac updates free to download, reports Macworld. Apple has kept OS X 10.7 Lion and OS X 10.8 Mountain Lion available for customers who have machines limited to the older software, but until recently, Apple was charging $19.99 to get download codes for the updates. As of last week, these updates no...
Pixel Stand 23W 668x445

Google Pixel 6 Rumored to Support 23W Wireless Charging, Beating iPhone 12's MagSafe

Wednesday September 1, 2021 1:54 am PDT by
Google is rumored to be working on a new wireless charging stand that could deliver 23W of charging power to its upcoming Pixel 6 and Pixel 6 Pro phones, according to a leaked inventory image published by Android Police. Image via Android Police. If true, that would beat the iPhone 12's maximum 15W wireless charging speed (or 12W on ‌iPhone 12 mini‌) using Apple's MagSafe charger, and...