Signing macOS packages with a Certificate

Last updated
Save as PDF

Apple Distribution Certificate

For security reasons, and to protect users, it may sometimes be required that you prevent unsigned (or unknown) packages from being deployed.

If you're downloading a PKG from a vendor's website, then this should not normally affect you. But, if you want to build your own packages (custom pre and post flight scripts, for example), or the application vendor hasn't signed their app (you should consider why this is), then here's a simple guide on how to sign a package for deployment using Meraki Systems Manager

Requirements:

You’ll need a developer account at https://developer.apple.com along with a paid for subscription.

Apple Developer Website

Log on to: https://developer.apple.com/account/resources/certificates/list
1. If redirected, go to Account > Certificate, IDs & Profiles
You should have any certificates already created. Click the +
Select Mac Installer Distribution, as shown, and click Continue
The site will now ask for your CSR...

Creating a CSR

Open Keychain Access on your Mac
Click Keychain Access > Certificate Assistant > Request a Certificate from a Certificate Authority.
Enter an email address in User Email Address.
In the Common Name field, enter a name for the key
Leave the CA Email Address field empty.
Choose “Saved to disk”, and click Continue, and save this.

More details here: https://help.apple.com/developer-account/#/devbfa00fef7

Requesting your certificate

Go back to your web page at Apple Developer
Under Create a New Certificate, click Choose File
Select the CertificateSigningRequest.certSigningRequest file you created earlier
Click Continue
You can now download your certificate
Double Click this to add to your Mac’s keychain (You may wish to create a new keychain to keep your developer certs)

Signing your package

You’ll need to know the identity of the signing certificate you created in the first section. You can find installed Identities with:

security find-identity -v -p codesigning

Open Terminal in the directory where your newly created install package is. We are going to use com.meraki.plistonly.pkg

Type:

productsign --sign 'Developer ID Installer: Paul Fidler (7H6G5F4D3D)' com.meraki.plistonly.pkg com.meraki.plistonly-signed.pkg

You’ll be prompted for the currently logged in user’s password.

You should see the following:

productsign: using timestamp authority for signature
productsign: signing product with identity "Developer ID Installer: Paul Fidler (7H6G5F4D3D)" from keychain /Users/Paul.Fidler/Library/Keychains/login.keychain-db
productsign: adding certificate "Developer ID Certification Authority"
productsign: adding certificate "Apple Root CA"
productsign: Wrote signed product archive to com.meraki.plistonly-signed.pkg

You now have a signed installer called com.meraki.plistonly-signed.pkg !

This is what was achieved and what was omitted in this how-to.