IMPORTANT The underlying issue here (FB8830007) was fixed in macOS 11.3, so the advice in this post is irrelevant if you’re building on that release or later.
Note This content is a repost of info from another thread because that thread is not world readable (it’s tied to the DTK programme).
A number of folks have reported problems where:
They have a product that supports older versions of macOS (anything prior to 10.11).
If they build their product on Intel, everything works.
If they build their product on Apple Silicon, it fails on those older versions of macOS.
A developer filed a bug about this (FB8830007) and, based on the diagnosis of that bug, I have some info to share as to what’s going wrong and how you can prevent it. Let’s start with some background.
macOS’s code signing architecture supports two different hash formats:
sha1, the original hash format, which is now deprecated
sha256, the new format, support for which was added in macOS 10.11
codesign should choose the signing format based on the deployment target:
If your deployment target is 10.11 or later, you get sha256.
If your deployment target is earlier, you get both sha1 and sha256.
This problem crops up because, when building for both Intel and Apple Silicon, your deployment targets are different. You might set the deployment target to 10.9 but, on Apple Silicon, that’s raised to the minimum Apple Silicon system, 11.0. So, which deployment target does it choose?
Well, the full answer to that is complex but the executive summary is that it chooses the deployment target of the current architecture, that is, Intel if you’re building on Intel and Apple Silicon if you’re building on Apple Silicon. For example:
intel% codesign -d --arch x86_64 -vvv Test664892.app
…
Hash choices=sha1,sha256
…
intel% codesign -d --arch arm64 -vvv Test664892.app
…
Hash choices=sha1,sha256
…
arm% codesign -d --arch x86_64 -vvv Test664892.app
…
Hash choices=sha256
…
arm% codesign -d --arch arm64 -vvv Test664892.app
…
Hash choices=sha256
…
The upshot is that you have problems if your deployment target is less than 10.11 and you sign on Apple Silicon. When you run on, say, macOS 10.10, the system looks for a sha1 hash, doesn’t find it, and complains.
The workaround is to supply the --digest-algorithm=sha1,sha256, which overrides the hash choice logic in codesign and causes it to include both hashes:
arm% codesign -s - --digest-algorithm=sha1,sha256 Test664892.app
arm% codesign -d --arch x86_64 -vvv Test664892.app
…
Hash choices=sha1,sha256
…
% codesign -d --arch arm64 -vvv Test664892.app
…
Hash choices=sha1,sha256
…
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
Demystify code signing and its importance in app development. Get help troubleshooting code signing issues and ensure your app is properly signed for distribution.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
Multiple notarization submissions have been stuck at
"In Progress" status for over 2 days with no resolution
or error:
4996643b-4512-4025-9648-028fbafca82f - submitted Jan 18
b6db6cd0-dad7-4a8e-b1fc-379467c1086d - submitted Jan 17
88f269c1-56ea-4404-98ba-edbe9a05b3d2 - submitted Jan 19
No logs available (notarytool log returns "not yet available"). The submissions were uploaded successfully and received submission IDs.
Is there a known issue with the notarization service?
Topic:
Code Signing
SubTopic:
Notarization
I want to help contribute a feature in a virtual-machine app in macOS that supports PCIe device passthrough over thunderbolt.
I have a question about the entitlements. Since I do not represent the GPU vendors, would I be allowed to get a driver signed that matches GPU vendor IDs? Is there such a thing as wildcard entitlement for PCIDriverKit?
I don't want end-users to have to disable SIP to be able to use this. Any suggestions/leads? Thank you.
Hello all,
I am attempting to notarize my newly made Mac OS application using the notarization command in VS Code.
"/Users/teejgotit/Desktop/Cursor Workspace/Rust CutContour v2/cutcontour-app/src-tauri/target/release/bundle/dmg/CC Studio_0.1.0_aarch64.dmg" \
--key "/Users/teejgotit/AppleCerts/AuthKey_MATVLX3.p8" \
--key-id "MATVLX9" \
--issuer "887ba428-aa39-4fb3-a3dc-f83b9145cab0" \
--wait
Only to be met with a continual "Current State: In Progress.."
for what has been about 1 day and 16 hours now.
Current status: In Progress........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
My app and project are rather small and was curious if this is a normal thing for this to day takes for a first time notarization?
Would love any help or feedback.
Hello,
I'm currently developing an iOS app that uses SensorKit.
Everything works fine in development and testing — the app correctly requests and receives SensorKit permissions on test devices.
In my App ID configuration, the SensorKit Reader Access entitlement (com.apple.developer.sensorkit.reader.allow) is included and visible in Xcode under the project’s entitlements list.
However, when I try to archive and distribute the app, I get the following errors in Xcode:
Provisioning profile failed qualification
Profile doesn't support SensorKit Reader Access.
Provisioning profile failed qualification
Profile doesn't include the com.apple.developer.sensorkit.reader.allow entitlement.
Even though my provisioning profile includes this entitlement, Xcode still refuses to distribute the app.
Here’s what I’ve confirmed so far:
The provisioning profile lists com.apple.developer.sensorkit.reader.allow in its entitlements.
SensorKit works perfectly in debug and development builds.
The issue only occurs when attempting to distribute (Archive → Distribute App).
Could this be because my account has only development entitlement for SensorKit and not the distribution entitlement?
If so, how can I verify or request the proper distribution entitlement for SensorKit Reader Access?
Thank you for any guidance or confirmation from Apple regarding this entitlement behavior.
I regularly see folks run into problems with their Developer ID signing identities. Historically I pointed them to my posts on this thread, but I’ve decided to collect these ideas together in one place.
If you have questions or comments, start a new thread here on DevForums and tag it with Developer ID so that I see it.
IMPORTANT Nothing I write here on DevForums is considered official documentation. It’s just my personal ramblings based on hard-won experience. There is a bunch of official documentation that covers the topics I touch on here, including:
Xcode documentation
Xcode Help
Developer Account Help
Developer > Support > Certificates
For a lot more information about code signing, see the Code Signing Resources pinned post.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
The Care and Feeding of Developer ID
Most Apple signing assets are replaceable. For example, if you accidentally lose access to your Apple Development signing identity, it’s a minor inconvenience. Just use the Developer website to revoke your previous certificate and create a replacement. Or have Xcode do that for you.
IMPORTANT If you don’t understand the difference between a certificate and a digital identity, and hence signing identity, read Certificate Signing Requests Explained before reading this post.
Some signing assets are precious. Losing access to such assets has significant consequences.
Foremost amongst those are Developer ID signing identities. These allow you to sign Mac products that ship independently. Anyone with access to your Developer ID signing identity can sign code as you. This has a number of consequences, both for you and for your relationship with Apple.
Identify a Developer ID Signing Identity
A Developer ID signing identity consists of two parts: the certificate and the private key. There are two different flavours, identifiable by the subject name in the certificate:
Developer ID Application — This is named Developer ID Application: TTT, where TTT identifies your team. Use this to sign code and disk images.
Developer ID Installer — This is named Developer ID Installer: TTT, where TTT identifies your team. Use this to sign installer packages.
Note If you do KEXT development, there’s a third flavour, namely a KEXT-enabled Developer ID Application signing identity. For more details, see KEXT Code Signing Problems.
This post focuses on traditional signing identities, where you manage the private key. Xcode Cloud introduced cloud signing, where signing identities are “stored securely in the cloud”. These identities have the Managed suffix in Certificates, Identifiers, and Profiles. For example, Developer ID Application Managed is the cloud signing equivalent of Developer ID Application. To learn more about cloud signing, watch WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing. To identify these certificates ‘in the wild’, see Identifying a Cloud Managed Signing Certificate.
Limit Access to Developer ID
Anyone with your Developer ID signing identity can sign code as you. Given that, be careful to limit access to these signing identities. This is true both for large organisations and small developers.
In a large organisation, ensure that only folks authorised to ship code on behalf of your organisation have access to your Developer ID signing identities. Most organisations have some sort of release process that they use to build, test, and authorise a release. This often involves a continuous integration (CI) system. Restrict CI access to only those folks involved in the release process.
Even if you’re a small developer with no formal release process, you can still take steps to restrict access to Developer ID signing identities. See Don’t Leak Your Private Key, below.
In all cases, don’t use your Developer ID signing identities for day-to-day development. That’s what Apple Development signing identities are for.
Create Developer ID Signing Identities as the Account Holder
Because Developer ID signing identities are precious, the Developer website will only let the Account Holder create them. For instructions on how to do this, see Developer Account Help > Create certificates > Create Developer ID certificates. For more information about programme roles, see Developer > Support > Program Roles.
IMPORTANT In an Organization team it’s common for the Account Holder to be non-technical. They may need help getting this done. For hints and tips on how to avoid problems while doing this, see Don’t Lose Your Private Key and Don’t Leak Your Private Key, both below.
Limit the Number of Developer ID Signing Identities You Create
Don’t create Developer ID signing identities unnecessarily. Most folks only need to create one. Well, one Developer ID Application and maybe one Developer ID Installer. A large organisation might need more, perhaps one for each sub-unit, but that’s it.
There are two reasons why this is important:
The more you have, the more likely it is for one to get into the wrong hands. Remember that anyone with your Developer ID signing identity can sign code as you.
The Developer website limits you to 5 Developer ID certificates.
Note I can never remember where this limit is actually documented, so here’s the exact quote from this page:
You can create up to five Developer ID Application certificates and up to five Developer ID Installer certificates using either your developer account or Xcode.
Don’t Lose Your Private Key
There are two standard processes for creating a Developer ID signing identity:
Developer website — See Developer Account Help > Create certificates > Create Developer ID certificates.
Xcode — See Xcode Help > Maintaining signing assets > Manage signing certificates.
Both processes implicitly create a private key in your login keychain. This makes it easy to lose your private key. For example:
If you do this on one Mac and then get a new Mac, you might forget to move the private key to the new Mac.
If you’re helping your Organization team’s Account Holder to create a Developer ID signing identity, you might forget to export the private key from their login keychain.
It also makes it easy to accidentally leave a copy of the private key on a machine that doesn’t need it; see Don’t Leak Your Private Key, below, for specific advice on that front.
Every time you create a Developer ID signing identity, it’s a good idea to make an independent backup of it. For advice on how to do that, see Back Up Your Signing Identities, below.
That technique is also useful if you need to copy the signing identity to a continuous integration system.
If you think you’ve lost the private key for a Developer ID signing identity, do a proper search for it. Finding it will save you a bunch of grief. You might be able to find it on your old Mac, in a backup, in a backup for your old Mac, and so on. For instructions on how to extract your private key from a general backup, see Recover a Signing Identity from a Mac Backup.
If you’re absolutely sure that you previous private key is lost, use the Developer website to create a replacement signing identity.
If the Developer website won’t let you create any more because you’ve hit the limit discussed above, talk to Developer Programs Support. Go to Apple > Developer > Contact Us and follow the path Development and Technical > Certificates, Identifiers, and Provisioning Profiles.
Don’t Leak Your Private Key
Anyone with your Developer ID signing identity can sign code as you. Thus, it’s important to take steps to prevent its private key from leaking.
A critical first step is to limit access to your Developer ID signing identities. For advice on that front, see Limit Access to Developer ID, above.
In an Organization team, only the Account Holder can create Developer ID signing identities. When they do this, a copy of the identity’s private key will most likely end up in their login keychain. Once you’ve exported the signing identity, and confirmed that everything is working, make sure to delete that copy of the private key.
Some organisations have specific rules for managing Developer ID signing identities. For example, an organisation might require that the private key be stored in a hardware token, which prevents it from being exported. Setting that up is a bit tricky, but it offers important security benefits.
Even without a hardware token, there are steps you can take to protect your Developer ID signing identity. For example, you might put it in a separate keychain, one with a different password and locking policy than your login keychain. That way signing code for distribution will prompt you to unlock the keychain, which reminds you that this is a significant event and ensures that you don’t do it accidentally.
If you believe that your private key has been compromised, follow the instructions in the Compromised Certificates section of Developer > Support > Certificates.
IMPORTANT Don’t go down this path if you’ve simply lost your private key.
Back Up Your Signing Identities
Given that Developer ID signing identities are precious, consider making an independent backup of them. To back up a signing identity to a PKCS#12 (.p12) file:
Launch Keychain Access.
At the top, select My Certificates.
On the left, select the keychain you use for signing identities. For most folks this is the login keychain.
Select the identity.
Choose File > Export Items.
In the file dialog, select Personal Information Exchange (.p12) in the File Format popup.
Enter a name, navigate to your preferred location, and click Save.
You might be prompted to enter the keychain password. If so, do that and click OK.
You will be prompted to enter a password to protect the identity. Use a strong password and save this securely in a password manager, corporate password store, on a piece of paper in a safe, or whatever.
You might be prompted to enter the keychain password again. If so, do that and click Allow.
The end result is a .p12 file holding your signing identity. Save that file in a secure location, and make sure that you have a way to connect it to the password you saved in step 9.
Remember to backup all your Developer ID signing identities, including the Developer ID Installer one if you created it.
To restore a signing identity from a backup:
Launch Keychain Access.
Choose File > Import Items.
In the open sheet, click Show Options.
Use the Destination Keychain popup to select the target keychain.
Navigate to and select the .p12 file, and then click Open.
Enter the .p12 file’s password and click OK.
If prompted, enter the destination keychain password and click OK.
Recover a Signing Identity from a Mac Backup
If you didn’t independently backup your Developer ID signing identity, you may still be able to recover it from a general backup of your Mac. To start, work out roughly when you created your Developer ID signing identity:
Download your Developer ID certificate from the Developer website.
In the Finder, Quick Look it.
The Not Valid Before field is the date you’re looking for.
Now it’s time to look in your backups. The exact details depend on the backup software you’re using, but the basic process runs something like this:
Look for a backup taken shortly after the date you determined above.
In that backup, look for the file ~/Library/Keychains/login.keychain.
Recover that to a convenient location, like your desktop. Don’t put it in ~/Library/Keychains because that’ll just confuse things.
Rename it to something unique, like login-YYYY-MM-DD.keychain, where YYYY-MM-DD is the date of the backup.
In Keychain Access, choose File > Add Keychain and, in the resulting standard file panel, choose that .keychain file.
On the left, select login-YYYY-MM-DD.
Chose File > Unlock Keychain “login-YYYY-MM-DD“.
In the resulting password dialog, enter your login password at the date of the backup.
At the top, select My Certificates.
Look through the list of digital identities to find the Developer ID identity you want. If you don’t see the one you’re looking for, see Further Recovery Tips below.
Export it using the process described at the start of Back Up Your Signing Identities.
Once you’re done, remove the keychain from Keychain Access:
On the left, select the login-YYYY-MM-DD keychain.
Choose File > Delete Keychain “login-YYYY-MM-DD”.
In the confirmation alert, click Remove Reference.
The login-YYYY-MM-DD.keychain is now just a file. You can trash it, keep it, whatever, at your discretion.
This process creates a .p12 file. To work with that, import it into your keychain using the process described at the end of Back Up Your Signing Identities.
IMPORTANT Keep that .p12 file as your own independent backup of your signing identity.
Further Recovery Tips
If, in the previous section, you can’t find the Developer ID identity you want, there are a few things you might do:
Look in a different backup.
If your account has more than one keychain, look in your other keychains.
If you have more than one login account, look at the keychains for your other accounts.
If you have more than one Mac, look at the backups for your other Macs.
The login-YYYY-MM-DD keychain might have the private key but not the certificate. Add your Developer ID certificate to that keychain to see if it pairs with a private key.
Revision History
2025-03-28 Excised the discussion of Xcode’s import and export feature because that was removed in Xcode 16.
2025-02-20 Added some clarification to the end of Don’t Leak Your Private Key.
2023-10-05 Added the Recover a Signing Identity from a Mac Backup and Further Recovery Tips sections.
2023-06-23 Added a link to Identifying a Cloud Managed Signing Certificate.
2023-06-21 First posted.
Hi! I am encountering an issue with the notarization process.
I'll leave here the outputs of a few command that I think might be useful.
user@AndreisMac % pkgutil --check-signature mypkg.pkg
Package "mypkg.pkg":
Status: signed by a developer certificate issued by Apple for distribution
Notarization: trusted by the Apple notary service
Signed with a trusted timestamp on: 2026-02-18 18:46:16 +0000
Certificate Chain:
...
user@AndreisMac % spctl -a -vv --type install mypkg.pkg
mypkg.pkg: rejected
origin=Developer ID Installer: MyComp LLC (ABCD)
user@AndreisMac % xcrun notarytool submit mypkg.pkg --keychain-profile "notary-profile" --wait
Conducting pre-submission checks for mypkg.pkg and initiating connection to the Apple notary service...
Submission ID received
id: e76f34b3-7c91-451c-a539-8fb39809a5bd
Upload progress: 100,00% (13,3 MB of 13,3 MB)
Successfully uploaded file
id: e76f34b3-7c91-451c-a539-8fb39809a5bd
path: /path/to/mypkg.pkg
Waiting for processing to complete.
Current status: Accepted...............
Processing complete
id: e76f34b3-7c91-451c-a539-8fb39809a5bd
status: Accepted
user@AndreisMac % spctl -a -vv --type install mypkg.pkg
mypkg.pkg: rejected
origin=Developer ID Installer: MyComp LLC (ABCD)
As you can see:
the installer is signed with a Developer ID Installer (the contents are signed and notarized as well)
the first spctl check is failing(even if the installer was already notarized on our build server)
trying to notarize again seems to work
checking again still shows the installer as rejected
I can run the installer locally by removing the quarantine flag, but this is not what I am expecting from a signed¬arized installer.
Interestingly enough, trying this installer on a different MacOS machine works as expected(no quarantine) and spctl shows it as notarized(Accepted).
Any idea what's wrong with my machine?
Hello, we are currently encountering a similar issue. We need to inject our capabilities into a third-party app by re-signing it (not a full re-signing process—just requiring the provisioning profile and certificate to match). However, this seems to affect the functionality of universal links. We've found that this issue only occurs on iOS 18.
We noticed that when re-signing the app, the entitlements related to associated domains are changed to a wildcard:
[Key] com.apple.developer.associated-domains
[Value]
[Array]
[String] *
However, this doesn’t cause any issues on iOS 17.
Through further testing, we discovered that in order for universal links to work properly, we need to restore the original value of com.apple.developer.associated-domains and use a provisioning profile that matches the app's bundle ID. This means our previous re-signing approach using a certificate and provisioning profile from another bundle will no longer work.
We’d like to ask: is this a new restriction introduced in iOS 18? If we manually restore the original com.apple.developer.associated-domains entitlement and use a provisioning profile that matches the app’s bundle ID, will universal links function correctly going forward?
Topic:
Code Signing
SubTopic:
Certificates, Identifiers & Profiles
Tags:
Entitlements
Provisioning Profiles
Universal Links
Code Signing
So we are building a Tauri app and I have no been able to get our App to be Notarized using Developer ID.
We have a ticket open for 3 months now. Can anyone help me out here?
{
"logFormatVersion": 1,
"jobId": "e2ec4d13-bb83-41d4-a497-ba80cf830af1",
"status": "Rejected",
"statusSummary": "Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions.",
"statusCode": 7000,
"archiveFilename": "HIDDEN",
"uploadDate": "2026-01-23T16:13:37.589Z",
"sha256": "fd52815d5edf14b66b25529e89c207b2acff2c41642261e1049a479f19f2b72f",
"ticketContents": null,
"issues": null
}
How do we escalate to engineering team?
Sincerely,
Nash Gadre
https://camouflagenetworks.com
Topic:
Code Signing
SubTopic:
Notarization
I've submitted my app four times, each time waiting a few hours for something to happen, then reducing the file size of my *.dmg and trying again. The first two seemed to have completed after 36 hours, but I no longer have that specific signed binary (and its a much smaller binary now anyway). The latest two are still "In Progress" and its almost been 48 hours.
I know my process isn't wrong, and my app isn't somehow incorrectly built or being denied because two were accepted. The outage page shows green for the notary tool (https://developer.apple.com/system-status/) so I'm not sure what the hold up is.
I am submitting .dmg notarization requests from Sequoia 15.7.3 using xcrun submit. My developer certificate was created in the last two weeks and is valid. I have had some successful notarizations already so I know that my configuration is correct. However, for the last 48 hours all of my submissions are stuck at 'in progress'. Is there an issue with the notarization service on Apple's side?
Topic:
Code Signing
SubTopic:
Notarization
When submitting my new build to app store connect directly from dreamflow, I get this error:
Failed Step: Flutter build ipa and automatic versioning
Building com.pinpictu for device (ios-release)...
════════════════════════════════════════════════════════════════════════════════
No valid code signing certificates were found
You can connect to your Apple Developer account by signing in with your Apple ID
in Xcode and create an iOS Development Certificate as well as a Provisioning
Profile for your project by:
1- Open the Flutter project's Xcode target with
open ios/Runner.xcworkspace
2- Select the 'Runner' project in the navigator then the 'Runner' target
in the project settings
3- Make sure a 'Development Team' is selected under Signing & Capabilities > Team.
You may need to:
- Log in with your Apple ID in Xcode first
- Ensure you have a valid unique Bundle ID
- Register your device with your Apple Developer Account
- Let Xcode automatically provision a profile for your app
4- Build or run your project again
5- Trust your newly created Development Certificate on your iOS device
via Settings > General > Device Management > [your new certificate] > Trust
For more information, please visit:
https://developer.apple.com/library/content/documentation/IDEs/Conceptual/
AppDistributionGuide/MaintainingCertificates/MaintainingCertificates.html
Or run on an iOS simulator without code signing
════════════════════════════════════════════════════════════════════════════════
No development certificates available to code sign app for device deployment
Build failed :|
Step 10 script Flutter build ipa and automatic versioning exited with status code 1
Please not I am on a windows pc, not a mac. I'm not sure how to clear this error and I am not an experinced coder, so any advice would be greatly appreciated, especially if it is simple and easy to follow.
Hi everyone,
I'm trying to add the Side Button Access entitlement to my voice-based conversational app following the documentation, but I'm unable to find it in Xcode.
Steps I followed:
Selected my app target in Xcode project navigator
Went to the Signing & Capabilities tab
Clicked the + Capability button
Searched for "Side Button Access"
Problem:
The "Side Button Access" option does not appear in the capabilities list at all.
Environment:
I'm developing and testing in Japan (where this feature should be available)
Xcode version: Xcode 26.2 beta 3
iOS deployment target: iOS 26.2
Questions:
Is there any pre-registration or special approval process required from Apple before this entitlement becomes available?
Are there any additional requirements or prerequisites I need to meet?
Is this feature already available, or is it still in a limited beta phase?
Any guidance would be greatly appreciated. Thank you!
When I try to archive an app in order to submit it to the App Store I receive the following errors I do not know how to fix:
error: Framework /Users/fbartolom/Library/Developer/Xcode/DerivedData/Virtual_Tags-apzduassdiglhcapscsllvzbfgid/Build/Intermediates.noindex/ArchiveIntermediates/Virtual Tags/InstallationBuildProductsLocation/Applications/VirtualTags.app/Frameworks/StoreKit.framework did not contain an Info.plist (in target 'VirtualTags' from project 'Virtual Tags') error: Framework /Users/fbartolom/Library/Developer/Xcode/DerivedData/Virtual_Tags-apzduassdiglhcapscsllvzbfgid/Build/Intermediates.noindex/ArchiveIntermediates/Virtual Tags/InstallationBuildProductsLocation/Applications/VirtualTags.app/Frameworks/Security.framework did not contain an Info.plist (in target 'VirtualTags' from project 'Virtual Tags') error: Framework /Users/fbartolom/Library/Developer/Xcode/DerivedData/Virtual_Tags-apzduassdiglhcapscsllvzbfgid/Build/Intermediates.noindex/ArchiveIntermediates/Virtual Tags/InstallationBuildProductsLocation/Applications/VirtualTags.app/Frameworks/CloudKit.framework did not contain an Info.plist (in target 'VirtualTags' from project 'Virtual Tags')
MacBook Pro M5, Tahoe 26.1, Xcode 26.1.1
Hi All,
I am building my own MDM server. It seems that in order for the MDM commands to function an MDM Push Certificate for the APNS framework. And in order to get the MDM Push Certificate from the Apple Push Certificates Portal (https://identity.apple.com/pushcert/) you need to upload your CSR usually provided and sign by the MDM Vendor of your choosing. I am familiar with this process.
But now that I am the MDM Vendor, I am not sure where to get this MDM Vendor CSR Signing Certificate.
I've already submitted a formal request via the "contact us" form. Apple's response pointed me to the documentation on Setting Up Push Notifications and the MDM Vendor CSR Signing Certificate help page (which I had already reviewed):
https://developer.apple.com/documentation/devicemanagement/setting-up-push-notifications-for-your-mdm-customers
https://developer.apple.com/help/account/certificates/mdm-vendor-csr-signing-certificate/
The issue is that these documents describe using the signing certificate, but not the process for obtaining it as a new, independent vendor.
So does anyone know of a portal or method of generating this “MDM Vendor Certificate”?
or maybe I'm going about this all wrong and there is a simpler way… the again, its apple, so I’m probably on the right path just beed a little direction please. (I am not sure where to get this MDM Vendor CSR Signing Certificate.)
Validation failed (409)
Missing Code Signing Entitlements. No entitlements found in bundle 'com.seeyon.yiboyun.child' for executable 'Payload/M3.app/PlugIns/CMPSharePublish.appex/CMPSharePublish'." (ID: 6e5429ed-b896-45a0-ab23-bb8fcb472072)
Topic:
Code Signing
SubTopic:
Entitlements
I'm trying to notarize an application for the first time & it's stuck for more than 24 hours now. I ended up submitting the same app more than 5 times, but all are stuck in waiting state.
There is no visibility into what's happening & whenever i check the status it just shows as "In Progress".
How can i expedite this process ?
Hi Team,
i'm running into same issue with notarization time. I create new, small app for a customer but however the notarization is running since this morning, so almost a few hours.
This isn't normal or ?
Is there anything what i can do ?
Best regard,
Lars
Topic:
Code Signing
SubTopic:
Notarization
Hi, I'm currently at 19 hours waiting for notarization. My dev account is new and this is the first time I'm submitting anything to be notarized. I've gathered from my research that this is normal (unfortunately). I figure the only thing I can do is wait, but is there any way for me to know if I'm waiting for a human to manually review it? I was going to file a support request, but I saw that they won't be responding to any support requests until after their Thanksgiving break, and I assume nobody is manually reviewing notary submissions for the next week+. I attached the submission below, thanks!
createdDate: 2025-11-21T21:17:10.082Z
id: c9746d42-1dc7-4641-aec1-62c6cedff1a2
name: ***********.zip
status: In Progress
Topic:
Code Signing
SubTopic:
Notarization
hey, trying to notarize my mac app rn. maybe servers are down. earlier today super fast but now slow and i need to ship.
anyone having similar issue?