doc: Note expired system certificate issue in how-to/code-signing/macOS

changes/3060.misc.md

@@ -0,0 +1 @@
+A note was added in the docs about expired intermediate Developer ID Apple certificates.

docs/en/how-to/code-signing/macOS.md

@@ -105,6 +105,10 @@ Congratulations! You've just successfully installed the Developer ID Application
 
 The *specific type* of the certificate you have just created is quite precious, and you should make sure to keep it safe. A single Developer ID Application Certificate can be used to [sign, notarize and distribute multiple applications](https://developer.apple.com/forums/thread/657993) outside of the Mac App store, which is why a [very limited number of them](https://help.apple.com/xcode/mac/current/#/dev3a05256b8) can be created on a particular Developer Account. You should consider making a backup copy, which will require you to export the certificate together with the associated private key from the Keychain. The procedure for doing so is [documented by Apple](https://support.apple.com/guide/keychain-access/import-and-export-keychain-items-kyca35961/mac).
 
+/// note | Issue: "Certificate is not trusted"
+
+If, when you install the certificate, you receive an error that "'Developer ID Application: [...]' certificate is not trusted", it most likely means your Developer ID intermediate certificate has expired. The intermediate certificate is needed to validate your application certificate; it is provided by Apple as part of the Xcode developer tools, and is updated regularly. If you have an older macOS or Xcode installation, it's possible you have an out of date intermediate certificate. To fix this issue, you need to either upgrade your system to the latest versions of macOS and Xcode (recommended), or download and install the latest [Developer ID - G2 certificate](https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer). Other up-to-date certificates can also be downloaded from [Apple PKI](https://www.apple.com/certificateauthority) if needed.
+
 ///
 
 ## Other types of Code Signing identities

docs/spelling_wordlist

@@ -1,11 +1,11 @@
 AAB
+ABIs
 ADB
 adhoc
 allowlist
 AlmaLinux
 amongst
 APIs
-ABIs
 APK
 appimage
 AppImage
@@ -46,9 +46,9 @@ cookiecutter
 Cookiecutter
 cryptographic
 CTRL
-CVE
 Curve
 customizations
+CVE
 datetime
 DBus
 debugpy
@@ -62,8 +62,8 @@ dmg
 DMGs
 DNS
 Dockerfile
-ECC
 drawable
+ECC
 embeddable
 executables
 FamilyWild
@@ -101,10 +101,10 @@ JSON
 Kerberos
 keychain
 Keychain
-keystore
-keystores
 keyring
 keyserver
+keystore
+keystores
 linters
 Linux
 linuxdeploy
@@ -122,11 +122,12 @@ manylinux
 MkDocs
 MSI
 MSIs
+MSVC
 Namespace
 Napari
 natively
-NET's
 NDK
+NET's
 NFS
 NSIS
 NumPy
@@ -142,16 +143,17 @@ PFX
 phablet
 PID
 pipx
+PKI
 PNG
 PowerShell
 ppb
 PR
 pre
 precompiled
+programmatically
 proxied
 Proxied
 proxying
-programmatically
 PRs
 PursuedPyBear
 px
@@ -178,9 +180,9 @@ ReST
 reStructuredText
 RGB
 RHEL
-RSA
 rpmbuild
 rpmsign
+RSA
 rst
 RTF
 rumdl
@@ -219,8 +221,8 @@ Toolset
 towncrier
 tox
 triaged
-troff
 Triaging
+troff
 TrustedPeople
 TrustedPublisher
 TTY
@@ -258,4 +260,3 @@ Xauth
 Xcode
 Xr
 Xs
-MSVC