I learned something about the Mac OS X Firewall that can be annoying this past weekend. If an application is not properly signed, or the application has changed since last being properly signed, then you have to repeatedly give it permissions to access network resources.

You see it all over the internet, mostly related to iTunes or Safari. I had it happen to me this weekend with another application.

Here’s my attempt sorting out the options, what I recommend and what’s going on behind the scenes.

There are two things you can do if this happens to you:

1. Uninstall and reinstall the application.
2. Sign the application yourself.

The first option was tempting, but I didn’t want to do this for three reasons: the application is gigabytes in size (would take a while), I had made customizations that would require a bit of time to re-add, and I’m not really solving a problem here, just skirting it. It could come back, and uninstalling/reinstalling is not an adequate solution.

The second option sounds scary, but it’s actually very easy. I will outline how to do the second option in simple steps.

Disclaimer: Signing an application yourself will make an application appear more secure to the operating system, when in reality it isn’t. Only sign applications that you are 100% sure are not spyware or otherwise malicious. If you have any doubts, just uninstall/reinstall.

 
Step 1: Validate the problem is a code signing problem

Open up Terminal, and type the following command:

The result I was getting with the problematic app was:

OK, so this is why my Firewall doesn’t trust it. It is signed, but it has changed in some way since the signature was made. This is a good thing, generally speaking. I only wish Mac OS X gave me an easy way to say, “trust it anyway,” as I know in this case the resource in question isn’t missing but was simply renamed and the developer forgot to resign the app. Mac OS X does not give me this option.

 
Step 2: Create a Signing Identity

The solution I’m going for – signing the app myself – requires that I create a Signing Identity, also known as Signing Certificate. This is very easy to do:

1. Open Applications > Utilities > Keychain Access.
2. From the Keychain Access menu, choose Certificate Assistant > Create a Certificate.
3. Fill in a name for the certificate. This name appears in the Keychain Access utility as the name of the certificate. This is also the name you will use when referencing this certificate. Personally, I used the name, “My Signing Identity.”
4. Choose Self Signed Root from the Type popup menu.
5. Check the Let me override defaults checkbox.
6. If you can at this point, choose Code Signing from the Certificate Type menu.
7. Click Continue.
8. Specify a serial number for the certificate. Any number will do as long as you have no other certificate with the same name and serial number.
9. If you can at this point, choose Code Signing from the Certificate Type menu.
10. Click Continue.
11. Fill in the information for the certificate. You can use real or fake data, I used real data personally.
12. Click Continue.
13. Accept the defaults for the rest of the dialogs.

Once completed, you will see your certificate in Keychain Access. Verify the name you picked, and you’re done with this step. Well done!

 
Step 3: Resign your application

Now you have to sign your application. To do this, open up Terminal again and use the following command:

The -s switch tells codesign you want to sign an application, and the -f switch tells codesign you want to force the signature, even if a signature already exists. “My Signing Identity” is the name of the certificate I created in the previous step in this process. Plug in the proper identity name (in quotes if there are spaces in the name, as there was in mine) and path to the problematic application.

If the command runs without error, you’re good to go.

Now, go ahead and validate by repeating Step 1 of this process. Type the following command in Terminal:

The result you should get this time is:

This is good.

 
Step 4: Re-add the Application to the Firewall’s Exceptions

You can do it either explicitly through the Security preferences pane in the System Preferences area, or you can just let the operating system prompt you: Do you want the application to accept incoming network connections? Either way, once you’ve given it access, Mac OS X will not ask you again. This was what I was going after.
 

 
In summary: If you’re having this problem, you can always sign the app yourself. This is risky business, so if you’re not 100% sure the application is safe, don’t do this; you’re better off uninstalling and reinstalling. But if uninstalling and reinstalling is prohibitive and you know the application is safe, you can use this method to get rid of the pesky, repetitive prompt by the operating system.

Further reading, for extra credit:

• Code Signing Guide
• Mac OS X Code Signing In-Depth

Related posts:

1. How to open a Mac OS X application with command line arguments
2. You have not chosen to trust “GeoTrust DV SSL CA”
3. How to burn an ISO to a USB drive on Mac OS X