Some time ago, an edge case involving macOS development certificates came up on the Xojo Forum. Despite the improvements introduced in Xojo 2026r1, I have to admit that this particular scenario fell outside of what we accounted for. Continue reading to learn more about this issue and its solution.
The issue the user was dealing with was the Developer ID popup menu showing a different name than expected for the Developer ID Team. Interestingly, this problem didn’t occur on his second Mac.
As a result, he was not able to select any of the “Build For” options, because the remaining developer certificates installed on that Mac were issued under the same Team ID but with a different Company Name.
In this particular case, a couple of X.509 certificates OIDs (think of these as certificate attributes) are worth highlighting:
- 2.5.4.11 – Organizational Unit Name (OU): This corresponds to the Team ID for Apple Developer Certificates. It is unique and never changes.
- 2.5.4.10 – Organization Name (O), also known as the Legal Entity or Company Name: This value can be changed from the Apple Developer portal, under Account > Membership Details, but only if your developer program membership is registered as an Organization (not an Individual).
The underlying problem
In this particular case, several factors converged:
- The certificate issued under the unexpected Team name had expired long time ago but was still present on that Mac. This part wasn’t too bad, Xojo can safely ignore expired certificates.
- The real issue was that this expired certificate had been installed on that Mac long before the other (correct) certificates using the current Organization Name. Because of this, when Xojo iterated through the installed certificates at the system level, it encountered the expired one first – and mistakenly used its Organization Name for all certificates sharing the same Team ID.
Now that we’re aware of this behavior, we have fixed it for Xojo 2026r3.
The Solution
Once we identified what was happening, the fix to this particular case was simple: delete the expired, offending certificate from the Keychain Access app on that Mac.
The Recipe
If you run into a similar issue, whether it is trouble selecting a specific Team ID, or missing “Build For” options, the best first step is to use the Inspect… option under the Developer ID popup menu.
The Certificate Inspector lists all installed certificates for every Team in a much simpler way than digging through Keychain Access. It also provides additional details and, when possible, direct actions to resolve some of the most common issues related to managing your Apple Developer Certificates.
Reviewing Certificates in More Depth
Alternatively, or if you are running a Xojo version prior to Xojo 2026r1, you can inspect your certificates manually by running the following command in Terminal:
security find-certificate -a -p | awk '/---BEGIN CERTIFICATE---/{flag=1; print; next} /---END CERTIFICATE---/{print; flag=0; print "---END---"} flag' | while IFS= read -r line; do if [ "$line" = "---END---" ]; then echo "$cert" | openssl x509 -noout -subject -enddate 2>/dev/null; cert=""; else cert="$cert$line"$'\n'; fi; doneThe output will list, in the Terminal window, all the Apple Developer certificates found on your computer along with some key pieces of information worth inspecting:
- CN (Common Name): Indicates the certificate type, for example, Development, Developer ID Application, or any other Apple development certificate.
- OU (Organizational Unit/Team ID): Remember, this value never changes for your Apple Developer Program membership.
- O (Organization): The current Organization Name associated with the certificate. This can be changed, but only for Organization-type membership (not Individual).
- notAfter. The expiration date for that certificate.
Conclusion
This edge case is a good reminder that expired certificates sitting in your Keychain can quietly cause unexpected issues. Thanks to the fix in Xojo 2026r3 and the new Certificate Inspector, spotting and resolving these problems are now much easier.
Javier Menendez is an engineer at Xojo and has been using Xojo since 1998. He lives in Castellón, Spain and hosts regular Xojo hangouts en español. Ask Javier questions on Twitter at @XojoES or on the Xojo Forum.