OS X codesigning certificate expriry

code-signingxcode

We use Apple code signing certificates to sign apps so that users can know we made the app. What happens to the users when our certificate expires?

Does it mean that app will now appear untrusted or does it only affect us and no longer let us sign code using that certificate?

Best Answer

When you sign an app using a code signing certificate, you are establishing an end date for that app (in terms of it having an unexpired cert).

You will not be affected directly (except hopefully for getting warnings that you are using an expired cert) but your users will notice when the expiration passes and they will not get a warning beforehand. One day it will break, precisely when their clock passes the date of expiration. It will still be signed of course, so you may want to prepare your customers to expect that the trust the OS extends to your your app will expire. They can choose to keep running the app by disabling the checks or stripping the code signing. You might also to supply users with newer versions of the same app that are re-signed should they want he same exact binary but simply extend the signing for a different time range.