I would like to sign my OS X installer using company certificate. I have .cer and .p12 files. I wonder if there is some way to do that without creating keychain. E.g. in 'productsign' tool flag --cert looks promising, but I can't find too much info about how to use it.


Apple's signing tools require a keychain containing your organisation's signing identity.

The cert flag on productsign is used to embed an intermediate certificate. It is not used to specify the signing certificate.

It is possible to create a keychain containing your organisation's signing identity. This can then be used to sign your installer using the keychain flag. The separate keychain file can be managed with source code control or other file management tools; it remains separate from the user's login keychain.

  • I was expecting this, but still wanted to make sure. So if pkg creation is last step of my build procedure, every developer will have to deploy certificate on his machine, right?
    – mszabc
    Oct 26 '15 at 13:10
  • Yes, if you want the developer to be able to sign, they must have the keychain on their Mac. You can sign the package as a separate pre-launch step. You could create an internal certificate for testing, see security.stackexchange.com/questions/17909 Oct 26 '15 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .