Skip to main content
Cisco Meraki Documentation

Signing macOS packages with a Certificate

Apple Distribution Certificate

For security reasons, and to protect users, it may sometimes be required that you prevent unsigned (or unknown) packages from being deployed.

If you're downloading a PKG from a vendor's website, then this should not normally affect you. But, if you want to build your own packages (custom pre and post flight scripts, for example), or the application vendor hasn't signed their app (you should consider why this is), then here's a simple guide on how to sign a package for deployment using Meraki Systems Manager




You’ll need a developer account at along with a paid for subscription.

Apple Developer Website

  1. Log on to:
    1. If redirected, go to Account > Certificate, IDs & Profiles
  2. You should have any certificates already created. Click the +
  3. Select Mac Installer Distribution, as shown, and click Continue PaulF_1-1665650422964.png
  4. The site will now ask for your CSR...


Creating a CSR

  1. Open Keychain Access on your Mac
  2. Click Keychain Access > Certificate Assistant > Request a Certificate from a Certificate Authority.
  3. Enter an email address in User Email Address.
  4. In the Common Name field, enter a name for the key
  5. Leave the CA Email Address field empty.
  6. Choose “Saved to disk”, and click Continue, and save this.




More details here:


Requesting your certificate

  1. Go back to your web page at Apple Developer
  2. Under Create a New Certificate, click Choose File
  3. Select the CertificateSigningRequest.certSigningRequest file you created earlier
  4. Click Continue
  5. You can now download your certificate
  6. Double Click this to add to your Mac’s keychain (You may wish to create a new keychain to keep your developer certs)






Signing your package

You’ll need to know the identity of the signing certificate you created in the first section. You can find installed Identities with:

security find-identity -v -p codesigning


Open Terminal in the directory where your newly created install package is. We are going to use com.meraki.plistonly.pkg 


productsign --sign 'Developer ID Installer: Paul Fidler (7H6G5F4D3D)' com.meraki.plistonly.pkg com.meraki.plistonly-signed.pkg


You’ll be prompted for the currently logged in user’s password.

You should see the following:

productsign: using timestamp authority for signature
productsign: signing product with identity "Developer ID Installer: Paul Fidler (7H6G5F4D3D)" from keychain /Users/Paul.Fidler/Library/Keychains/login.keychain-db
productsign: adding certificate "Developer ID Certification Authority"
productsign: adding certificate "Apple Root CA"
productsign: Wrote signed product archive to com.meraki.plistonly-signed.pkg

You now have a signed installer called com.meraki.plistonly-signed.pkg !

This is what was achieved and what was omitted in this how-to.


  • Was this article helpful?