Code signing certificate is the umbrella term for the Apple-issued certificates that prove a binary, installer, or token came from a specific developer team. Every certificate type has a narrow scope and a paired use, so picking the right one is most of the battle.
The types you will actually encounter
- Apple Development
- Signs builds for the developer's registered devices. Daily debugging. Universal across iOS, iPadOS, macOS, tvOS, watchOS, visionOS.
- Apple Distribution
- Signs builds for TestFlight, the App Store, and Ad Hoc distribution. The modern unified replacement for iOS Distribution and Mac App Distribution.
- Developer ID Application
- Signs Mac apps distributed outside the Mac App Store. Required input for notarization.
- Developer ID Installer
- Signs the .pkg installer that wraps a Developer ID Application-signed Mac binary.
- Mac Installer Distribution
- Signs the .pkg installer for Mac App Store submissions. Paired with an Apple Distribution certificate for the inner app binary.
- Apple Push Services / APNs
- Signs the token your server sends to APNs to send push notifications. Increasingly replaced by an APNs auth key (.p8), which never expires.
- Pass Type ID
- Signs Apple Wallet passes. One per pass type identifier (boarding passes, loyalty cards, event tickets).
- Apple Pay Merchant ID
- Identifies a merchant for Apple Pay. Paired with a Payment Processing certificate that decrypts payment tokens.
Every type shares the same plumbing
- Issued from a certificate signing request (CSR) generated by an Apple Developer Program member.
- Chains up to the Apple Root CA through a WWDR intermediate certificate.
- Has a fixed expiration (one year for most, longer for Developer ID and Pass Type ID).
- Can be revoked from the Apple Developer portal, which invalidates the signature on every binary that depended on it.