Apple’s receipt-certificate change had a second milestone

Apple’s receipt-signing transition did not consist of one date. Its August 2023 record introduced the SHA-256 requirement for specified paths; the January 2025 record covered the older certificate’s expiry. Earlier transition; Later milestone.

What the sequence changes

A team that checked only a newly submitted build in 2023 should not assume that it thereby inspected every older supported binary or validation path. That is an inference about test coverage, not a claim that those binaries failed when the certificate expired.

The follow-up therefore narrows the remaining question: where does receipt validation occur in the product that players currently use? Different components or historical releases can require different evidence. An announcement about certificate handling does not reveal the implementation inside a game.

Keep payment diagnosis ahead of marketing diagnosis

Our recommendation is to verify transaction fulfilment before treating an unexplained purchase discontinuity as a change in acquired-player quality. Trace a controlled purchase to the entitlement and the recorded revenue event, documenting the build and environment.

The timeline preserves both platform milestones so an inherited incident report can be read in context. It supplies no estimate of lost sales and no claim that this transition caused a particular studio’s revenue movement. A subsequent edition would need actual permitted transaction evidence to go beyond the documented platform sequence and assess implementation results.

Inspect the evidence

Download the announcement-to-outcome evidence timeline. The extraction separates documented facts from our analysis and unknowns.

Further reading in the existing archive: Blended ROAS Calculation: Where It Quietly Goes Wrong; Web shop attribution: measuring D2C without breaking your MMP setup. These links provide background; this check does not independently verify their full contents.

Frequently asked questions

What happened next, and what should UA change after: Apple’s receipt-certificate change had a second milestone?

Keep both platform milestones visible, and put payment diagnosis ahead of marketing diagnosis. Apple’s receipt-signing transition was not one date: the August 2023 record introduced the SHA-256 requirement for specified submission and sandbox paths, and the January 2025 record covered the older SHA-1 receipt-signing intermediate certificate’s expiry. A team that checked only a newly submitted build in 2023 should not assume it inspected every older supported binary or validation path — that is an inference about test coverage, not a claim those binaries failed when the certificate expired. Narrow the remaining question to where receipt validation occurs in the product players currently use; different components or historical releases can need different evidence. Verify transaction fulfilment before treating an unexplained purchase discontinuity as a change in acquired-player quality: trace a controlled purchase to the entitlement and the recorded revenue event, documenting build and environment. The timeline supplies no estimate of lost sales and no claim that this transition caused a particular studio’s revenue movement.