If you develop software for macOS — whether it’s a simple utility app, a desktop productivity tool, or a complex enterprise program — code signing is not just a security checkbox. It’s an absolute requirement.
Apple’s entire ecosystem is built around trust. The operating system, Gatekeeper, and Notarization systems all rely on digital signatures to verify that your software really comes from you, hasn’t been tampered with, and meets Apple’s security policies.
Without a valid code signature, your Mac app won’t install cleanly. Users will see scary warnings like “This app can’t be opened because it is from an unidentified developer” — or worse, the system will block your app entirely.
So where does DigiCert fit into this? While Apple provides its own Developer ID Certificates, many Mac developers use DigiCert Code Signing Certificates too — especially if they’re building cross-platform apps, signing browser plugins, distributing enterprise tools, or maintaining consistent security policies across Windows and macOS.
This guide will explain how DigiCert Code Signing works for Mac developers, when you need it, how it interacts with Apple’s notarization process, and the best practices to keep your app secure and trusted by every Mac user.
Why Code Signing is Essential on macOS
Unlike some operating systems where unsigned apps can still be installed easily, macOS is very strict. Apple’s Gatekeeper — the security feature that checks apps when users download them — looks for:
-
A valid code signature from a trusted identity.
-
A Developer ID issued by Apple or a certificate trusted by the system.
-
Whether the app has been notarized by Apple for modern macOS versions.
If your app fails any of these checks, the user will see a bright red warning that your software may be dangerous. Many people simply won’t proceed — they’ll look for an alternative that doesn’t look suspicious.
Apple Developer ID vs. DigiCert Code Signing: What’s the Difference?
If you build apps for distribution to end-users through direct downloads (not the Mac App Store), Apple requires you to sign your app with a Developer ID Application Certificate, issued directly by Apple via your Apple Developer account.
But that’s not the whole story.
Many Mac developers also use a third-party certificate authority like DigiCert for additional layers of trust and flexibility:
-
✅ Cross-Platform Signing: If your app is also available for Windows or Linux, you may want a single, reputable CA to issue all your code signing certificates. DigiCert’s root is trusted by all major OS platforms, so you don’t have to juggle multiple authorities.
-
✅ Enterprise & Internal Distribution: For custom enterprise software distributed internally (not through the App Store), many companies prefer DigiCert for unified certificate management and compliance.
-
✅ Browser Plugins & Cross-Browser Trust: If your Mac app installs plugins or extensions that need to be trusted by browsers like Chrome, Safari, or Firefox, a DigiCert Code Signing Certificate can simplify multi-platform trust.
-
✅ Unified SmartScreen & Gatekeeper Trust: If your software needs to bypass Microsoft SmartScreen and Apple Gatekeeper, using a well-known CA like DigiCert helps build reputation and consistency.
How macOS Gatekeeper Works with Code Signing
Gatekeeper is macOS’s system for verifying that an app:
1️⃣ Comes from a trusted developer (Developer ID signature).
2️⃣ Hasn’t been modified after signing (signature integrity).
3️⃣ Is notarized by Apple (for macOS Catalina and later).
When you sign your app bundle (.app or .pkg), you’re embedding a cryptographic signature that says:
“This software came from me. Here’s proof.”
If Gatekeeper sees a valid signature, the user can run your app without overriding system security settings. If the signature is missing or broken, the app won’t run by default — the user has to use Control-click + Open, which most everyday users won’t bother with.
Notarization: A Required Extra Step
Starting with macOS Catalina (10.15), Apple added another layer: Notarization.
Even if your app is signed, Gatekeeper now checks whether the app has been notarized by Apple. Notarization is an automated scan where you upload your signed app to Apple. They run security checks (malware scanning, known threats) and attach a notarization ticket.
If your app isn’t notarized, Gatekeeper may block it outright — especially if the user’s security settings are set to default.
How DigiCert Code Signing Fits Into macOS Notarization
Here’s how DigiCert works in this context:
-
You sign your app with your DigiCert Code Signing Certificate if you want consistent identity across platforms.
-
You then notarize the signed app with Apple.
-
Apple verifies your signature as part of the notarization process.
-
If you only have DigiCert and not an Apple Developer ID, your notarization may fail — so for public distribution, you’ll still need an Apple Developer ID Application Certificate.
-
For internal or cross-platform builds, DigiCert helps maintain consistency — especially if your build process signs Windows
.exeor.msifiles too.
So in practice, many Mac developers use both:
-
An Apple Developer ID Certificate for App Store or public Gatekeeper distribution.
-
A DigiCert Code Signing Certificate for consistency across Windows/macOS, enterprise signing, or internal tools.
How to Sign and Notarize a macOS App
Here’s the typical process — in narrative steps:
1️⃣ Build Your App Bundle
You build your .app or .pkg using Xcode or your preferred toolchain. Double-check that your bundle ID, version, and entitlements are correct.
2️⃣ Sign Your App
Use the codesign command in Terminal to sign your app.
For example:
If you’re using DigiCert for internal signing, you’d reference the DigiCert identity installed in your keychain.
3️⃣ Verify the Signature
Run:
Check for errors — they can break notarization.
4️⃣ Submit for Notarization
Use xcrun altool or Xcode Organizer to upload your signed app to Apple for notarization:
Wait for Apple to approve. They’ll send an email if the notarization passes or fails.
5️⃣ Staple the Notarization Ticket
Once approved, “staple” the ticket to your app:
This attaches Apple’s notarization proof so Gatekeeper can verify it offline.
6️⃣ Test the Final Build
Run:
This confirms Gatekeeper recognizes your signature and notarization.
Best Practices for Mac Code Signing with DigiCert
✔️ Always Timestamp:
Use a trusted timestamp server so your signature remains valid even after your cert expires.
✔️ Use Secure Key Storage:
For OV, secure your private key. For EV, store your signing key on a hardware token.
✔️ Renew Early:
Keep your certificates renewed ahead of expiry to avoid failed builds or broken trust chains.
✔️ Combine with Developer ID:
For public macOS apps, always maintain your Apple Developer ID — DigiCert complements but does not replace Apple’s notarization requirements.
✔️ Automate Where Possible:
Integrate signing and notarization into your CI/CD pipeline for smooth releases.
Conclusion
Code signing is non-negotiable for Mac developers — it’s how you prove your identity, protect your users, and ensure your apps run without warnings or blocks.
A DigiCert Code Signing Certificate gives you extra flexibility: you can sign cross-platform installers, Windows apps, drivers, and internal enterprise tools while keeping your software reputation strong and your release process secure.
For most Mac developers, the best approach is both:
-
Use Apple’s Developer ID for Gatekeeper trust and notarization.
-
Use DigiCert to unify your signing across all platforms and projects.
Build once, sign correctly, protect your brand — and make sure your users can install your software without fear.
