Is this .pkg signed by the Developer ID CA that expires on 1 February 2027?

Check a package

Your files never leave your browser. The page reads only the package's header and table of contents (usually a few kilobytes, even for a multi-gigabyte package) on your own computer. Nothing is uploaded: the page's security policy blocks it from sending data anywhere.

What the results mean

Old CA: re-sign

The signer's certificate was issued by the original Developer ID Certification Authority (organisational unit Apple Certification Authority, SHA-256 7AFC9D01…). Apple: Starting February 1, 2027, .pkg files signed with an affected certificate will no longer install. Re-sign all packages with your new certificate before this date.

G2: OK

Issued by Developer ID Certification Authority with organisational unit G2 (SHA-256 F16CD3C5…, valid to 2031). Not affected by this cutoff.

Unsigned

No signature, so nothing expires. Jamf PreStage enrollment, the MDM InstallEnterpriseApplication command and Intune line-of-business apps need a signed package anyway.

Not Developer ID

Signed with a different kind of certificate (Apple's own software updates, Mac App Store, an in-house CA). This cutoff is about Developer ID only.

Both CAs have the same name, Developer ID Certification Authority, and chain to the same Apple Root CA. Only the organisational unit, the fingerprint and the expiry date tell them apart. The signer certificate's own expiry date does not: Apple notes that the expiration date alone doesn't prove which authority issued a certificate.

What this check does and doesn't do

• It reads the certificates stored in a flat package's signature and identifies the intermediate CA by fingerprint, or by the issuer's organisational unit when only the signer certificate is present.
• It does not verify the signature itself, revocation or notarization. pkgutil --check-signature does, so every result shows the exact command to confirm it on a Mac.
• It checks the package you drop, not packages nested inside it. Old bundle-style packages (folders) and disk images can't be read in a browser; open the disk image and drop the .pkg inside.
• Apps you have already installed are not affected. Apple: Previously signed and notarized Mac software (with a secure timestamp) will keep working. The cutoff is about installing packages.

Read the full explanation: Apple's notice, which install paths fail (Installer, Jamf, Munki, Intune, MDM), and how to check a folder of packages with pkgutil.