Some Mac App Store Apps 'Damaged' Due to Expired Security Certificate

[MacRumors]

A growing number of MacRumors readers and Twitter users have been experiencing an issue with some Mac App Store apps displaying a "damaged" error when opened since late Wednesday. The issue has affected popular apps such as 1Password, Acorn, Byword, DaisyDisk and Tweetbot.

Mac App Store apps with a "damaged" error (Image: Graham/Twitter)​

Mac users are prompted with this error message when opening Mac App Store apps:

"App Name" is damaged and can't be opened. Delete "App Name" and download it again from the App Store.

Tweetbot developer Paul Haddad tweeted that the issue appears to be related to security certificates that expired on November 11, 2015, and he further speculated that the receipts now using SHA256 encryption may be causing problems with older OS X versions.

Wonder if the receipt now being SHA256 is causing problems with old OS versions? pic.twitter.com/ozOssXWlBR - Paul Haddad (@tapbot_paul) November 12, 2015

The issue, however, also appears to affect some users running OS X El Capitan, leading Haddad to believe that Mac App Store apps contacting Apple's servers simultaneously may be causing a "self inflicted DDOS on Apple's receipt generation service."

Haddad says that rebooting your Mac on OS X 10.10 or later may resolve the issue, while some users have been forced to reinstall apps from the Mac App Store, disconnect from and reopen the Mac App Store or simply reenter their Apple ID password.

It appears that Apple has since set a new 2035 expiration date for the security certificates, per The Guardian, at least some for apps, but the issues are persisting for some. Apple did not respond to request for comment.

Update: Rene Ritchie at iMore has further explained what's causing Mac apps to report as "damaged" and what can be done about it.

Article Link: Some Mac App Store Apps 'Damaged' Due to Expired Security Certificate

 

[IscariotJ]

Yup, had this with 1Password on 10.11....

 

[Bokito]

The problem with corrupted apps has been with the MAS for me since day one. I have the idea downloaders aren't validated, so corruption that occurs isn't fixed by the MAS, but you need to entirely redownload things.

 

[Nero Wolfe]

Had this problem with iFlicks 2, Reeder 3, Tweetbot, Checkbook Pro, some MAS Games, Art Text 2, White Noise, Movist. Kind of not at all funny. Deleting and re-downloading worked for all but Checkbook Pro. In a few cases I lost my preferences and settings.

[OS X 10.11.1]



Edit: (If you are having the same trouble as I am with Checkbook Pro contact Splasm software (support@splasm.com) and they will provide instructions on getting a non-MAS version to get you up and running in the meantime.)

 

[pianojoe]

Now, this is embarrassing.

 

[macguru212]

Not good to put all your eggs in one basket.

 

[KagatoAlpha]

Same problem with 1Password....

 

[4004786]

Happened to me with Sketch 3. I'm on the latest El Capitan.

 

[BeSweeet]

Had this issue with Tweetbot, though it simply asked for the Apple ID username and password.

 

[sk1wbw]

I've been using OS X since the very day it came out and I haven't EVER seen this before. I thought it might have been related to doing a Migration Assistant because I did that last week to my new iMac.

 

[b.inazawa-fan]

Happened to me with Tweetbot on 10.11 and 10.9. Signing in again fixed it on 10.11, but nothing could make it work again on 10.9. If Haddad's tweet is correct, they might've killed App Store apps for 10.9 indefinitely, unless they go back and make an old cert just for it. Which won't happen, knowing Apple.

 

[kastorff]

Same here. Running El Capitan. Last night I had two apps show up "damaged", and I reinstalled to fix. This morning I had 4 more, and logged out of the App Store and back in to fix. Annoying.

 

[audunhaugland]

I can't start iTunes. The problem started yesterday. Nice to know it's not something I did wrong

 

[rembert]

Had this issue with Tweetbot, though it simply asked for the Apple ID username and password.

Same here, 1Password suddenly asked for Apple ID username and password as "it was purchased on another computer". Ehr... ok... why now? Been updating 1Password for quite some years on this laptop.

With DaisyDisk I do get that "is damaged" error. I can wait if this resolves itself. But I use 1Password *very* often, should be perfectly reliable.

 

[ArtOfWarfare]

Happened to me with Tweetbot on 10.11 and 10.9. Signing in again fixed it on 10.11, but nothing could make it work again on 10.9. If Haddad's tweet is correct, they might've killed App Store apps for 10.9 indefinitely, unless they go back and make an old cert just for it. Which won't happen, knowing Apple.

Why are you still running 10.9? Aren't the requirements identical for 10.9, 10.10, and 10.11 (I don't remember... my MacMini is stuck at 10.6 because it only has 1 GB of RAM and 10.7 requires 2 GB, and my MacBook Air is stuck at 10.7... I don't remember why.)

 

[arpi]

Why are you still running 10.9? Aren't the requirements identical for 10.9, 10.10, and 10.11 (I don't remember... my MacMini is stuck at 10.6 because it only has 1 GB of RAM and 10.7 requires 2 GB, and my MacBook Air is stuck at 10.7... I don't remember why.)

I'm also running Mavericks. Much more stable then these new crap OSes. Also faster and fewer bells and whistles. I don't like beta software on production machines. El Capitan is beta quality.

 

[BigZ243]

Happened to me with Piezo. Just thought something corrupted.

 

[jpsaffron]

Same problem with 1password on 10.11.1. It appears that the Apple Worldwide Developer Relations Certification Authority certificate expired yesterday. Oops:

$ openssl pkcs7 -inform der -in /Applications/1Password.app/Contents/_MASReceipt/receipt -print_certs -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
18:59:43:21:72:74:9c:fc
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, O=Apple Inc., OU=Apple Worldwide Developer Relations, CN=Apple Worldwide Developer Relations Certification Authority
Validity
Not Before: Nov 11 21:58:01 2010 GMT
Not After : Nov 11 21:58:01 2015 GMT
Subject: CN=Mac App Store Receipt Signing, OU=Apple Worldwide Developer Relations, O=Apple Inc., C=US

 

[Arcus]

Same problem with 1password on 10.11.1. It appears that the Apple Worldwide Developer Relations Certification Authority certificate expired yesterday. Oops:

$ openssl pkcs7 -inform der -in /Applications/1Password.app/Contents/_MASReceipt/receipt -print_certs -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
18:59:43:21:72:74:9c:fc
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, O=Apple Inc., OU=Apple Worldwide Developer Relations, CN=Apple Worldwide Developer Relations Certification Authority
Validity
Not Before: Nov 11 21:58:01 2010 GMT
Not After : Nov 11 21:58:01 2015 GMT
Subject: CN=Mac App Store Receipt Signing, OU=Apple Worldwide Developer Relations, O=Apple Inc., C=US

Derp.

 

[vmachiel]

Try rebooting, that apparently helps.

 

[Oblivious.Robot]

I'm not sure if this is related but right after turning the Macbook on, I couldn't open any apps!

Was worried that I might have been hacked or some other paranoia, didn't sign in through the pop up window but instead signed in through App Store, sort of fixed whatever it was.

 

[zorinlynx]

I'm also running Mavericks. Much more stable then these new crap OSes. Also faster and fewer bells and whistles. I don't like beta software on production machines. El Capitan is beta quality.

We must be running different versions of El Capitan, because for me it's been rock solid.

 

[chinanderm]

Last night, I was prompted to sign in to the App Store in order to use Tweetbot. This morning, same thing for ReadKit.

Related?

 

[maxsix]

It only affects my iPhone...

My Nexus 6 and Moto X Pure continue to be the best smartphones I own.

If only Apple would improve their quality...ha..ha..ha....

Sorry iPhone Lovers..
I just had to bring up Android since the haters always do.






(relax it's just a bit of humor)

 

[2457282]

We must be running different versions of El Capitan, because for me it's been rock solid.

Agreed. I installed the latest beta this morning and therefore had to sign in again and poof no worries. Seems like a small annoyance that is easily solved by relogging in. SHouldn't happen but not that biggie either.