Mac App signed with Developer ID fails to start, I get com.apple.developer.networking.vpn.api entitl

I am developing an application that runs on OSX and uses the NEVPNManager for IKEv2 connections introduced in El Capitan. In order to setup/activate a VPN connection it requires the "Personal VPN" entitlement.

If I sign my application with a Development certificate it works as expected on my machine, or on others if they bypass Gatekeeper. However if I sign it with a Developer ID certificate the app fails to start. codesign -vvv and spctl -a say that there's nothing wrong with it's signature but in the system.log file I see this when I try to run the app.

Nov 19 11:00:01 taskgated[562]: no application identifier provided, can't use provisioning profiles [pid=22401] Nov 19 11:00:01 taskgated[562]: killed com.myorg.myapp[pid 22401] because its use of the com.apple.developer.networking.vpn.api entitlement is not allowed (error code -67050)

Could the Personal VPN capability be forbidden for use outside the Mac App Store? If so it makes no sense as it does not use any Apple service.


After talking to someone at Apple, it has become clear that the Personal VPN feature is not allowed to be used outside the App Store, thus it cannot be used along with a Developer ID certificate. Here is the list of which feature is allowed for which kind of code signing [the list here]


I know this question is old, but I wanted to provide an update. As of macOS 10.12 and XCode 8, Mac Apps signed with a Developer ID are allowed outside the Mac App Store. Apps signed in this way will run on both 10.11 and 10.12 without issue. This was a change I requested at WWDC 2016, which was implemented. You will see that the list OP linked to has been updated.


  • Sign java applet so that it works on OS X 10.8 Mountain Lion and Windows
  • JavaScript Xpath: return result as string
  • How to codesign and enable the hardened runtime for a 3rd-party CLI on Xcode?
  • Setting vault password in Ansible Tower
  • Application failed codesign verification
  • How to get subchild values from parent node from XML file parsing in JavaScript in XUL
  • Application failed codesign verification. [duplicate]
  • REST Web Service - Dynamic Query Parameters
  • trigger.io - Can't create ipa-file anymore
  • 'SOCK_RAW' option in 'socket' system call
  • Ansible sudo hangs after 5 tasks
  • PHP OOXML Libraries? [closed]
  • How can I make a right-click behave as a left-click for the purpose of selecting or focusing an obje
  • ASPNetCore MVC Routing Let Server Handle Specific Route
  • npm 5.4.1 install/uninstall all failing
  • ADO and msqli connections very slow
  • OpenGL 3.3 on Mac OSX El Capitan with LWJGL
  • Using $this when not in object context
  • Sails.js/waterline: Executing waterline queries in toJSON function of a model?
  • Deselecting radio buttons while keeping the View Model in synch
  • Getting last autonumber in access
  • Counter field in MS Access, how to generate?
  • javaw.exe and eclipse startup problems
  • Incrementing object id automatically JS constructor (static method and variable)
  • How to check if every primary key value is being referenced as foreign key in another table
  • Running a C# exe file
  • Can I have the cursor start on a particular column by default in jqgrid's edit mode?
  • Symfony2: How to get request parameter
  • jquery mobile loadPage not working
  • Function pointer “assignment from incompatible pointer type” only when using vararg ellipsis
  • Akka Routing: Reply's send to router ends up as dead letters
  • Is there a mandatory requirement to switch app.yaml?
  • using conditional logic : check if record exists; if it does, update it, if not, create it
  • How to delete a row from a dynamic generate table using jquery?
  • json Serialization in asp
  • Rails 2: use form_for to build a form covering multiple objects of the same class
  • python regex in pyparsing
  • How to stop GridView from loading again when I press back button?
  • Android Google Maps API OnLocationChanged only called once
  • How can I use threading to 'tick' a timer to be accessed by other threads?