You can now easily request access to managed capabilities for your App IDs directly from the new Capability Requests tab in Certificates, Identifiers & Profiles > Identifiers. With this update, view available capabilities in one convenient location, check the status of your requested capabilities, and see any notes from Apple related to your requests. Learn more about capability requests.

General: Forums topic: Code Signing Forums subtopics: Code Signing > General, Code Signing > Certificates, Identifiers & Profiles, Code Signing > Notarization, Code Signing > Entitlements Forums tags: Code Signing, Signing Certificates, Provisioning Profiles, Entitlements Developer Account Help — This document is good in general but, in particular, the Reference section is chock-full of useful information, including the names and purposes of all certificate types issued by Apple Developer web site, tables of which capabilities are supported by which distribution models on iOS and macOS, and information on how to use managed capabilities. Developer > Support > Certificates covers some important policy issues Bundle Resources > Entitlements documentation TN3125 Inside Code Signing: Provisioning Profiles — This includes links to the other technotes in the Inside Code Signing series. WWDC 2021 Session 10204 Distribute apps in Xcode with cloud signing Certificate Signing Requests Explained forums post --deep Considered Harmful forums post Don’t Run App Store Distribution-Signed Code forums post Resolving errSecInternalComponent errors during code signing forums post Finding a Capability’s Distribution Restrictions forums post Signing code with a hardware-based code-signing identity forums post New Capabilities Request Tab in Certificates, Identifiers & Profiles forums post Isolating Code Signing Problems from Build Problems forums post Investigating Third-Party IDE Code-Signing Problems forums post Determining if an entitlement is real forums post Code Signing Identifiers Explained forums post Mac code signing: Forums tag: Developer ID Creating distribution-signed code for macOS documentation Packaging Mac software for distribution documentation Placing Content in a Bundle documentation Embedding nonstandard code structures in a bundle documentation Embedding a command-line tool in a sandboxed app documentation Signing a daemon with a restricted entitlement documentation Defining launch environment and library constraints documentation WWDC 2023 Session 10266 Protect your Mac app with environment constraints TN2206 macOS Code Signing In Depth archived technote — This doc has mostly been replaced by the other resources linked to here but it still contains a few unique tidbits and it’s a great historical reference. Manual Code Signing Example forums post The Care and Feeding of Developer ID forums post TestFlight, Provisioning Profiles, and the Mac App Store forums post For problems with notarisation, see Notarisation Resources. For problems with the trusted execution system, including Gatekeeper, see Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

Xcode is prompting I enter a codesign login password when I am archiving my project. My password seems incorrect since there is no action after I enter my password and tap allow. what could be the problem?

General: Forums topic: Code Signing Forums subtopic: Code Signing > Notarization Forums tag: Notarization WWDC 2018 Session 702 Your Apps and the Future of macOS Security WWDC 2019 Session 703 All About Notarization WWDC 2021 Session 10261 Faster and simpler notarization for Mac apps WWDC 2022 Session 10109 What’s new in notarization for Mac apps — Amongst other things, this introduced the Notary REST API Notarizing macOS Software Before Distribution documentation Customizing the Notarization Workflow documentation Resolving Common Notarization Issues documentation Notary REST API documentation TN3147 Migrating to the latest notarization tool technote Fetching the Notary Log forums post Q&A with the Mac notary service team Developer > News post Apple notary service update Developer > News post Notarisation and the macOS 10.9 SDK forums post Testing a Notarised Product forums post Notarisation Fundamentals forums post The Pros and Cons of Stapling forums post Resolving Error 65 When Stapling forums post Many notarisation issues are actually code signing or trusted execution issue. For more on those topics, see Code Signing Resources and Trusted Execution Resources. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hi, I read that notarization should be fairly quick. I thought that it was stuck, so I ended up sending a few submissions of the same app. I was wondering if you'd able to tell me the status of my latest submission (id: a094f93d-8bb2-47fe-a411-b6e357456ec7). It has been saying "In Progress" for over 3 hours now. If it is held for in-depth review, would you be able to tell me what's the wait period is like? Thanks!

I'm trying to notarize an application for the first time & it's stuck for more than 24 hours now. I ended up submitting the same app more than 5 times, but all are stuck in waiting state. There is no visibility into what's happening & whenever i check the status it just shows as "In Progress". How can i expedite this process ?

I have a pass type id that expired. I created a CSR in keychain access on my Mac. I uploaded the CSR and generated a new cert. I downloaded the new cert and imported into keychain access. I don't see the associated private key and I cannot export a .p12 certificate. It's possible I started with the wrong key to generate the CSR or maybe I inadvertently deleted key while trying to locate the cert after importing. I'm not sure how to determine which. I do still have the private key from the cert that expired. But, I cannot figure out how to sign a cert again, my only option now is download. I've been searching the forum and while there may be an answer, I may just be looking for the wrong thing. I could use some help if anybody would be so kind.

I followed the instruction on Preparing your app to be the default browser or email client. I have acquired the permission from Apple. The entitlement is included in the provisioning profile. mailto is specified in URL Schemes. But I downloaded my app from TestFlight and enter Setting > MyApp, the switch that could enable my app to be the default email app was not there. I have no clue what I did it wrong. Does anyone know how to configure the app properly?

To ship a product outside of the Mac App Store, you must notarise it. The notary service issues a notarised ticket, and the ultimate consumer of that ticket is Gatekeeper. However, Gatekeeper does not just check the ticket; it also applies a variety of other checks, and it’s possible for those checks to fail even if your notarised ticket is just fine. To avoid such problems showing up in the field, test your product’s compatibility with Gatekeeper before shipping it. To do this: Set up a fresh machine, one that’s never seen your product before. If your product supports macOS 10.15.x, x < 4, the best OS version to test with is 10.15.3 [1]. Download your product in a way that quarantines it (for example, using Safari). Disconnect the machine from the network. It might make sense to skip this step. See the discussion below. Install and use your product as your users would. If the product is signed, notarised, and stapled correctly, everything should work. If not, you’ll need to investigate what’s making Gatekeeper unhappy, fix that, and then retest. For detailed advice on that topic, see Resolving Trusted Execution Problems. Run this test on a fresh machine each time. This is necessary because Gatekeeper caches information about your product and it’s not easy to reset that cache. Your best option is to do this testing on a virtual machine (VM). Take a snapshot of the VM before the first test, and then restore to that snapshot when you want to retest. Also, by using a VM you can disable networking in step 3 without disrupting other work on your machine. The reason why you should disable networking in step 3 is to test that you’ve correctly stapled the notarised ticket on to your product. If, for some reason, you’re unable to do that stapling, it’s fine to skip step 3. However, be aware that this may cause problems for a user if they try to deploy your product to a Mac that does not have access to the wider Internet. For more background on this, see The Pros and Cons of Stapling. [1] macOS 10.15.4 fixes a bug that made Gatekeeper unnecessarily strict (r. 57278824), so by testing on 10.15.3 you’re exercising the worst case. The process described above is by far the best way to test your Gatekeeper compatibility because it accurately tests how your users run your product. However, you can also run a quick, albeit less accurate test, using various command-line tools. The exact process depends on the type of product you’re trying to check: App — Run syspolicy_check like this: % syspolicy_check distribution WaffleVarnish.app This tool was introduced in macOS 14. On older systems, use the older spctl tool. Run it like this: % spctl -a -t exec -vvv WaffleVarnish.app Be aware, however, that this check is much less accurate. Disk image — Run spctl like this: % spctl -a -t open -vvv --context context:primary-signature WaffleVarnish.dmg Installer package — Run spctl like this: % spctl -a -t install -vvv WaffleVarnish.pkg Other code — Run codesign like this: % codesign -vvvv -R="notarized" --check-notarization WaffleVarnish.bundle This command requires macOS 10.15 or later. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com" Revision history: 2024-12-05 Added instructions for using syspolicy_check. Made other minor editorial changes. 2023-10-20 Added links to Resolving Trusted Execution Problems and The Pros and Cons of Stapling. Made other minor editorial changes. 2021-02-26 Fixed the formatting. 2020-04-17 Added the section discussing spctl. 2020-03-25 First version.

Notarization submission has been stuck in "In Progress" status for over 15 hours with no resolution. Hi there, I am trying to roll out distribution to paid users who are unable to receive anything from me for quite some time now, and I've read that notarization is quick. But I've found myself to be under quite a delay. Wondering if I could please get some help. Submission Details: ID: e3dff14c-16ab-41a7-a81c-0d1774c66588 Submitted: 2026-02-08T16:42:07.377Z File: Resonant-0.1.0-arm64.dmg (~200MB) Status: In Progress (stuck) Evidence: Upload completed successfully within minutes Delay is entirely server-side processing Same app structure notarized successfully on Feb 5 (submission f5f4c241) Multiple other submissions stuck since Feb 5 (see history below) Stuck Submissions (all "In Progress" for days): e3dff14c (Feb 8, 16:42 UTC) - 15+ hours 3e6bdcb5 (Feb 8, 16:11 UTC) - 16+ hours 37fd1b9f (Feb 8, 12:53 UTC) - 20+ hours f21a1d9b (Feb 8, 12:31 UTC) - 20+ hours (different app, Clippa.zip) 417244e8 (Feb 8, 06:18 UTC) - 26+ hours 891f370f (Feb 7, 11:44 UTC) - 2+ days 1debba51 (Feb 7, 05:44 UTC) - 2+ days 6a06b87f (Feb 6, 14:16 UTC) - 3+ days 9867261c (Feb 6, 13:44 UTC) - 3+ days 1a7c3967 (Feb 6, 12:58 UTC) - 3+ days Last Successful Notarization: f5f4c241 (Feb 5, 18:24 UTC) - Accepted in normal timeframe Impact: Unable to distribute production release. This is blocking critical bug fixes from reaching users. Expected Behavior: Notarization should complete within 2-10 minutes as documented and as experienced prior to Feb 5. Request: Please investigate why submissions are not being processed and either: Clear the backlog and process pending submissions Provide guidance on how to proceed with distribution

Hello all, I am attempting to notarize my newly made Mac OS application using the notarization command in VS Code. "/Users/teejgotit/Desktop/Cursor Workspace/Rust CutContour v2/cutcontour-app/src-tauri/target/release/bundle/dmg/CC Studio_0.1.0_aarch64.dmg" \ --key "/Users/teejgotit/AppleCerts/AuthKey_MATVLX3.p8" \ --key-id "MATVLX9" \ --issuer "887ba428-aa39-4fb3-a3dc-f83b9145cab0" \ --wait Only to be met with a continual "Current State: In Progress.." for what has been about 1 day and 16 hours now. Current status: In Progress........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ My app and project are rather small and was curious if this is a normal thing for this to day takes for a first time notarization? Would love any help or feedback.

Anyone know how long it takes to get Apple to respond to a request for provisioning for endpoint security?

I am building an electron app bundled with python. My code signing was fast, but when it came to notarization, it has already taken over 6+ hours. How can I speed things up?

hey, trying to notarize my mac app rn. maybe servers are down. earlier today super fast but now slow and i need to ship. anyone having similar issue?

My notarization submission been "In Progress" status for over 30 minutes now. I thought this process should be much faster.

After upgrading the iOS system to 18.3.1, the APP crashed continuously when it was launched. The following log was seen in the device log： Bootstrapping failed for <FBApplicationProcess: 0x72ad16b80; app<com.xxxx.yyyy>:> with error: <NSError: 0x300cd4d80; domain: RBSRequestErrorDomain; code: 5; "Launch failed."> { NSUnderlyingError = <NSError: 0x300cd4ab0; domain: NSPOSIXErrorDomain; code: 85> { NSLocalizedDescription = Launchd job spawn failed; }; } Our APP is in-house distribution What are the possible causes? How can I solve it?

When submitting my new build to app store connect directly from dreamflow, I get this error: Failed Step: Flutter build ipa and automatic versioning Building com.pinpictu for device (ios-release)... ════════════════════════════════════════════════════════════════════════════════ No valid code signing certificates were found You can connect to your Apple Developer account by signing in with your Apple ID in Xcode and create an iOS Development Certificate as well as a Provisioning Profile for your project by: 1- Open the Flutter project's Xcode target with open ios/Runner.xcworkspace 2- Select the 'Runner' project in the navigator then the 'Runner' target in the project settings 3- Make sure a 'Development Team' is selected under Signing & Capabilities > Team. You may need to: - Log in with your Apple ID in Xcode first - Ensure you have a valid unique Bundle ID - Register your device with your Apple Developer Account - Let Xcode automatically provision a profile for your app 4- Build or run your project again 5- Trust your newly created Development Certificate on your iOS device via Settings > General > Device Management > [your new certificate] > Trust For more information, please visit: https://developer.apple.com/library/content/documentation/IDEs/Conceptual/ AppDistributionGuide/MaintainingCertificates/MaintainingCertificates.html Or run on an iOS simulator without code signing ════════════════════════════════════════════════════════════════════════════════ No development certificates available to code sign app for device deployment Build failed :| Step 10 script Flutter build ipa and automatic versioning exited with status code 1 Please not I am on a windows pc, not a mac. I'm not sure how to clear this error and I am not an experinced coder, so any advice would be greatly appreciated, especially if it is simple and easy to follow.

Error in application:didFailToRegisterForRemoteNotificationsWithError: no valid aps-environment entitlement string found for application have tried out the below commands % codesign -d --entitlements - /path/to/your.app % security cms -D -i /path/to/your.app/embedded.mobileprovision and it seems both are working fine, Im currently developing react native app with expo and firebase for notifications this works fine when im running it via installing the app from testflight, but the issue occurs when i test in testflight or while the apple team reviewing my app My entitlements file <dict> <key>aps-environment</key> <string>production</string> </dict> </plist>

Hi guys, I am new to the Apple Developer Program (enrolled a few days ago) and this is my first app notarization attempt. I've been experiencing significant delays - all submissions have been stuck at "In Progress" for over 24 hours. Details: macOS app signed with Developer ID Application certificate Using xcrun notarytool with app-specific password Hardened runtime enabled codesign --verify --deep --strict passes Team ID: QVHM976XC5 Submission IDs (all stuck "In Progress"): 5f494a89-0db0-4cc6-944f-ca2fe399e870 (latest - 8+ hours) 938f6b8d-0d00-45f5-861d-68fe470df6c2 d0edcbfe-8464-455f-b077-bebaa5b9aab7 I understand new developers may experience longer initial processing, but 24+ hours seems excessive. Is there anything I should check or any additional steps required for new accounts? Any guidance appreciated.

Greetings! I've notarized my app but it spends always over 1 hour. I think it's because the app size is about 30GB, but is there any way to reduce it?

So we are building a Tauri app and I have no been able to get our App to be Notarized using Developer ID. We have a ticket open for 3 months now. Can anyone help me out here? { "logFormatVersion": 1, "jobId": "e2ec4d13-bb83-41d4-a497-ba80cf830af1", "status": "Rejected", "statusSummary": "Team is not yet configured for notarization. Please contact Developer Programs Support at developer.apple.com under the topic Development and Technical / Other Development or Technical Questions.", "statusCode": 7000, "archiveFilename": "HIDDEN", "uploadDate": "2026-01-23T16:13:37.589Z", "sha256": "fd52815d5edf14b66b25529e89c207b2acff2c41642261e1049a479f19f2b72f", "ticketContents": null, "issues": null } How do we escalate to engineering team? Sincerely, Nash Gadre https://camouflagenetworks.com

Hi All, I am building my own MDM server. It seems that in order for the MDM commands to function an MDM Push Certificate for the APNS framework. And in order to get the MDM Push Certificate from the Apple Push Certificates Portal (https://identity.apple.com/pushcert/) you need to upload your CSR usually provided and sign by the MDM Vendor of your choosing. I am familiar with this process. But now that I am the MDM Vendor, I am not sure where to get this MDM Vendor CSR Signing Certificate. I've already submitted a formal request via the "contact us" form. Apple's response pointed me to the documentation on Setting Up Push Notifications and the MDM Vendor CSR Signing Certificate help page (which I had already reviewed): https://developer.apple.com/documentation/devicemanagement/setting-up-push-notifications-for-your-mdm-customers https://developer.apple.com/help/account/certificates/mdm-vendor-csr-signing-certificate/ The issue is that these documents describe using the signing certificate, but not the process for obtaining it as a new, independent vendor. So does anyone know of a portal or method of generating this “MDM Vendor Certificate”? or maybe I'm going about this all wrong and there is a simpler way… the again, its apple, so I’m probably on the right path just beed a little direction please. (I am not sure where to get this MDM Vendor CSR Signing Certificate.)