Mac app is damaged and can't be opened

macOS uses the Keychain for certificate trust, and App Damaged Error related to SSL or certificate errors often reflects Keychain state rather than the certificate itself being invalid. When a corporate CA certificate is added to the system Keychain, macOS trusts it in Safari and Chrome (which use the system Keychain) but not necessarily in other tools. Node.js, Python's requests library, and Git each maintain their own certificate trust stores and do not automatically use the macOS Keychain. Add CA certificates to each tool's trust store explicitly: for Node.js, set NODE_EXTRA_CA_CERTS=/path/to/ca.pem; for Python requests, set REQUESTS_CA_BUNDLE=/path/to/ca.pem; for Git, run git config --global http.sslCAInfo /path/to/ca.pem. The Keychain utility security find-certificate -a -p > all-certs.pem exports all trusted certificates from the system Keychain, which can serve as the CA bundle for tools that need it. Verify certificate trust with openssl s_client -connect host:443 -CAfile /path/to/ca.pem.