Use a Developer ID Application certificate to sign a Mac app you distribute yourself, outside the Mac App Store. Use a Mac App Distribution certificate for apps you submit to the Mac App Store. The two are not interchangeable, and notarization rejects an app signed with the wrong one.
The short definitions
A code signing certificate ties a signature on your software to an identity Apple has issued. Apple publishes a list of certificate types, and several of them look alike by name. Four matter for most Mac teams.
| Certificate | What Apple says it is for |
|---|---|
| Developer ID Application | Sign a Mac app before distributing it outside the Mac App Store |
| Developer ID Installer | Sign and distribute a Mac Installer Package outside the Mac App Store |
| Mac App Distribution | Sign a Mac app before submitting it to the Mac App Store |
| Mac Installer Distribution | Sign and submit an installer package containing your signed app to the Mac App Store |
The names split into two families. Anything with "Developer ID" is for the direct route. Anything with "Mac App" or "Mac Installer Distribution" is for the store route.
Why the wrong choice fails late
Apple's notarization documentation is direct about this. To notarize, you must use a Developer ID certificate for your signature, and it says not to use a Mac Distribution, ad hoc, Apple Developer, or local development certificate. If you sign with another type, notarization fails and tells you so.
The failure usually shows up at the end of a release, in the notarization step, not while you sign. A build can sign cleanly, pass your own checks, and still be rejected. That is why it helps to confirm the certificate type before you submit.
What goes with what
Apple's resolving-issues page also separates the two Developer ID certificates by file type. Sign Mach-O files, disk images, bundles, apps and command line tools with a Developer ID Application certificate. Sign installer packages with a Developer ID Installer certificate. A common slip is to sign a .pkg with the application certificate because it was the one in the keychain.
If you ship both a disk image and an installer package, you need both Developer ID certificates in your signing setup.
Who can create and hold them
Apple's certificate page notes that distribution certificates belong to the team, and that only the Account Holder or an Admin can create them. It also says only one of each distribution certificate type is allowed per team, with Developer ID certificates as the exception. In practice that means signing identity ownership is a team question you should settle early, not something a single developer sorts out on a laptop.
Plan for the access question too. If one person holds the only copy of the private key, a laptop failure can stall a release. Decide where the key lives, who can use it in CI, and who can create a replacement.
A quick way to decide
- Will users get the app from the Mac App Store? Use the Mac App Distribution and Mac Installer Distribution certificates.
- Will users download it from your website or an update feed? Use Developer ID Application, plus Developer ID Installer if you ship a package.
- Do you do both? Keep two separate build and signing paths and label the artifacts clearly, so a store build never goes out on your website.
Where Safeguard fits
Signing shows who built an app, not what dependencies are inside it. Safeguard scans dependencies and produces SBOMs so you can review what ships in a signed build. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Can I use one certificate for both the App Store and my website?
No. Apple lists them as separate certificate types with separate purposes. Developer ID is for distribution outside the store, and Mac App Distribution is for the store.
Which certificate does notarization accept?
Apple states that you can only notarize software signed with a Developer ID certificate. Other certificate types cause notarization to fail.
Do I need a different certificate for an installer package?
Yes, for direct distribution. Apple says to sign installer packages with a Developer ID Installer certificate, and apps and other code with Developer ID Application.
Sources
- Apple Developer: Certificates
- Apple Developer: Notarizing macOS software before distribution
- Apple Developer: Resolving common notarization issues
Last reviewed: 19 October 2026.
