[macOS] Elastic Endpoint 9.0.8 system extension fails notarization validation with -67050 and "Unable to parse ticket"

## Summary

Elastic Endpoint 9.0.8 fails to activate `co.elastic.systemextension` on a specific macOS host.

The system extension is successfully staged and explicitly allowed by the MDM System Extension policy, but macOS `sysextd` fails during notarization/code requirement validation and immediately uninstalls the extension.

The most relevant errors are:

```text
applyPolicy co.elastic.systemextension -> Allow
Activation decision ... is: Allow
validating extension with identifier co.elastic.systemextension

MacOS error: 3
Error checking with notarization daemon: 3

bundle code signature is not valid - does not satisfy requirement:
-67050 code failed to satisfy specified code requirement(s)

co.elastic.systemextension: extension failed to validate! uninstalling...
````

At the same time, `syspolicyd` repeatedly logs:

```text
Unable to parse ticket.
error registering ticket: -1
```

A healthy Mac with the same macOS build and same Elastic Endpoint binary successfully recognizes the same software as notarized and activates the system extension.

---

## Environment

Affected host:

* macOS: 26.6.2
* Build: 25G83
* Architecture: arm64
* Elastic Agent: 9.0.8
* Elastic Endpoint: 9.0.8
* System Extension:

* Bundle ID: `co.elastic.systemextension`
* Team ID: `2BT3HPN62Z`

Deployment:

* Elastic Agent deployed on enterprise-managed macOS devices
* Jamf Pro is used for MDM configuration profiles
* Elastic Defend integration enabled

The issue only occurs on a small number of Macs. Most endpoints using the same deployment configuration work normally.

---

## Actual Behavior

`systemextensionsctl list` does not show the Elastic system extension.

Elastic Endpoint repeatedly attempts to activate the system extension.

The activation process reaches:

```text
realizing
-> staging
-> validating
```

The MDM policy explicitly allows the extension:

```text
applyPolicy co.elastic.systemextension -> Allow
Activation decision ... is: Allow
```

However, validation fails:

```text
MacOS error: 3
Error checking with notarization daemon: 3
bundle code signature is not valid - does not satisfy requirement:
-67050 code failed to satisfy specified code requirement(s)
```

The extension is then immediately removed:

```text
extension failed to validate! uninstalling...
advancing state from validating to uninstalling
advancing state from uninstalling to uninstalled
```

This loop occurred repeatedly.

During the collected period:

```text
Activation requests: 580
MDM Allow decisions: 580
Validation attempts: 580
Notarization daemon errors: 580
MacOS error 3: 580
Error -67050: 580
Validation failures: 580
Uninstall events: 580
```

---

## Code Signature Validation

The affected host reports that the system extension itself is valid on disk:

```text
co.elastic.systemextension.systemextension: valid on disk
co.elastic.systemextension.systemextension: satisfies its Designated Requirement

Identifier=co.elastic.systemextension
TeamIdentifier=2BT3HPN62Z
Authority=Developer ID Application: Elasticsearch, Inc (2BT3HPN62Z)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
```

However:

```text
codesign -vvvv -R="notarized" --check-notarization ...
```

returns:

```text
valid on disk
satisfies its Designated Requirement
test-requirement: code failed to satisfy specified code requirement(s)
```

and:

```text
spctl --assess --type install --verbose=4 \
co.elastic.systemextension.systemextension
```

returns:

```text
rejected
source=Unnotarized Developer ID
```

---

## Outer ElasticEndpoint.app

The outer application is also validly signed:

```text
/Applications/ElasticEndpoint.app: valid on disk
/Applications/ElasticEndpoint.app: satisfies its Designated Requirement
```

Its signing metadata shows:

```text
Identifier=co.elastic.endpoint
TeamIdentifier=2BT3HPN62Z
Notarization Ticket=stapled
```

However, on the affected host:

```text
syspolicy_check distribution /Applications/ElasticEndpoint.app --verbose
```

eventually reports:

```text
Top level policy match: dev id
Deep policy match: none

App has failed one or more pre-distribution checks.

Codesign Error
Severity: Fatal
Type: Notary Error

Gatekeeper rejected this file.
```

`syspolicyd` also repeatedly reports:

```text
Unable to parse ticket.
error registering ticket: -1
```

---

## Healthy Host Comparison

A healthy host was tested with:

* macOS: 26.6.2
* Build: 25G83
* Architecture: arm64
* Elastic Endpoint: 9.0.8

The outer ElasticEndpoint binary has the same CDHash:

```text
ed692fdf611e8e90f072403b31e322d0bfc0f201
```

On the healthy host:

```text
Notarization Ticket=stapled

/Applications/ElasticEndpoint.app:
valid on disk
satisfies its Designated Requirement
explicit requirement satisfied
```

The system extension is accepted as:

```text
accepted
source=Notarized Developer ID
```

`syspolicy_check` reports:

```text
Top level policy match: notarized
Deep policy match: notarized
Passed Gatekeeper scan
App passed all pre-distribution checks and is ready for distribution.
```

The Elastic system extension activates successfully on this host.

---

## Provisioning Profile

The system extension provisioning profile appears valid:

```text
Name: Elastic Endpoint System Extension
TeamIdentifier: 2BT3HPN62Z
ExpirationDate: 2041-02-23
```

Relevant entitlements are present:

```text
com.apple.developer.endpoint-security.client = true
com.apple.developer.networking.networkextension
com.apple.application-identifier = 2BT3HPN62Z.co.elastic.systemextension
com.apple.developer.system-extension.install = true
com.apple.developer.team-identifier = 2BT3HPN62Z
```

---

## Network / Apple Services

No explicit HTTP/HTTPS/SOCKS proxy is configured.

Connectivity and TLS validation succeeded for:

```text
api.apple-cloudkit.com:443
valid.apple.com:443
certs.apple.com:443
ocsp2.apple.com:443
ocsp.apple.com:80
crl.apple.com:80
```

The observed TLS certificates were issued by Apple public CAs and certificate verification succeeded.

No SSL inspection was observed in these tests.

---

## Expected Behavior

`co.elastic.systemextension` should successfully pass macOS validation and appear in:

```bash
systemextensionsctl list
```

as:

```text
[activated enabled]
```

The affected host should behave the same as the healthy host using the same Elastic Endpoint version and macOS build.

---

## Additional Observations

The strongest correlation observed on the affected host is:

```text
syspolicyd:
looking up ticket

syspolicyd:
Unable to parse ticket
error registering ticket: -1

sysextd:
Error checking with notarization daemon: 3

sysextd:
-67050 code failed to satisfy specified code requirement(s)

sysextd:
extension failed to validate
```

The issue appears host-specific because another host with the same:

* macOS version/build
* architecture
* Elastic Endpoint version
* ElasticEndpoint binary CDHash

successfully recognizes the software as notarized.

---

## Questions

1. Is this a known issue with Elastic Endpoint 9.0.8 system extension notarization on macOS 26?
2. Is the notarization ticket embedded/stapled with Elastic Endpoint 9.0.8 expected to be directly recognized for `co.elastic.systemextension`?
3. Have you seen `syspolicyd: Unable to parse ticket` / `error registering ticket: -1` with Elastic Endpoint before?
4. Are there any supported remediation steps for rebuilding or refreshing the notarization/Gatekeeper state without erasing the affected Mac?
5. Would you like the collected `sysdiagnose`, Unified Log archive, Elastic Endpoint logs, or Elastic Agent diagnostics for further analysis?

Start by comparing the affected and healthy hosts with systemextensionsctl, codesign, spctl, and syspolicy_check. Review the sysextd and syspolicyd messages, including “Unable to parse ticket,” alongside the collected diagnostics. Done means identifying the host-specific validation cause and documenting supported remediation so co.elastic.systemextension activates successfully.

Written by the indexing model from the issue text.