Profile Signer

Profile Signer

Sign .mobileconfig profiles and .pkg installers with a certificate from your keychain. Runs only on your Mac and never sends files anywhere.

A signed profile shows as Verified when it's installed by hand, and can't be changed without breaking the signature. Use Profile Unsigner to do the reverse.

Before you start

Choose your signing certificate in Preferences → Profile Signing Certificate. Only identities (a certificate together with its private key) in your keychain are listed. Until you've chosen one, Profile Signer shows No signing certificate selected with a Choose in Preferences… button.

How to use it

1. Drop one or more .mobileconfig or .pkg files onto the window, or click Choose Files…
2. Each file is signed straight away and listed, newest first. A file that couldn't be signed shows the reason.
3. Click Save… on a row to save that file, or Save All… to choose a folder for every file that hasn't been saved yet. Clear empties the list.

Signed files are named <name>_signed.mobileconfig or <name>_signed.pkg. The original file is never changed.

How files are signed

File	Signature
.mobileconfig	A CMS (PKCS #7) signature, the format macOS and iOS expect for signed profiles. The certificate chain (apart from the root) is included, so the device doesn't need the intermediate certificates already installed. If the chain can't be built from your keychain, only the signing certificate is included
.pkg	A standard XAR RSA signature, the same kind productsign writes. Only RSA certificates are supported for packages. Any existing signature is replaced

To sign packages for distribution outside your organisation, use a Developer ID Installer certificate. Gatekeeper doesn't trust packages signed with other certificates.

A profile that's already signed is signed again as it is, wrapping the old signature. Unsign it with Profile Unsigner first.

Messages

Message	What to do
No signing certificate selected — choose one in Preferences	Choose a certificate in Preferences
The selected signing certificate could not be found in the keychain	The certificate was removed or renewed. Choose it again in Preferences, and click Refresh if it's missing from the list
Only RSA certificates are supported for package signing	Use an RSA certificate for .pkg files
Not a .mobileconfig or .pkg file / Not a valid .pkg file	Check the file type

macOS may ask for permission to use the certificate's private key the first time you sign. Click Allow or Always Allow.

Permissions: none. Profile Signer doesn't connect to Jamf Pro.