diff --git a/CMakeLists.txt b/CMakeLists.txt
index cb549593..ff5da555 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -157,16 +157,10 @@ set(CPACK_PACKAGE_VERSION "${PROJECT_VERSION}")
 ##### Host specific settings
 
 if(APPLE)
-  if (DEFINED ENV{APPLE_DEVELOPER})
-    set(APPLE_CERT_3PARTY_INST "3rd Party Mac Developer Installer: $ENV{APPLE_DEVELOPER}")
-    set(APPLE_CERT_3PARTY_APP "3rd Party Mac Developer Application: $ENV{APPLE_DEVELOPER}")
-    set(APPLE_CERT_ID_APP "Developer ID Application: $ENV{APPLE_DEVELOPER}")
-    set(MACDEPLOYQT_SIGN -codesign=${APPLE_CERT_ID_APP}
-			 -timestamp -always-overwrite
-    )
-  endif()
   set_target_properties(${CMAKE_PROJECT_NAME} PROPERTIES
 	MACOSX_BUNDLE TRUE
+	XCODE_ATTRIBUTE_INSTALL_PATH /Applications
+	XCODE_ATTRIBUTE_SKIP_INSTALL No
 	RESOURCE "${APP_RESOURCES}"
   )
   get_target_property(qmake_executable Qt5::qmake IMPORTED_LOCATION)
@@ -175,9 +169,17 @@ if(APPLE)
 
   add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
     COMMAND ${MACDEPLOYQT_EXECUTABLE} $<TARGET_FILE_DIR:${PROJECT_NAME}>/../..
-        -always-overwrite ${MACDEPLOYQT_SIGN}
+        -always-overwrite
     COMMENT "Running macdeployqt..."
   )
+  if (DEFINED ENV{APPLE_DEVELOPER_HASH})
+    add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
+      COMMAND codesign --deep --signature-size=96000 --options=runtime --timestamp
+                --force -s "$ENV{APPLE_DEVELOPER_HASH}"
+		$<TARGET_FILE_DIR:${PROJECT_NAME}>/../..
+      COMMENT "Running codesign for $ENV{APPLE_DEVELOPER} ..."
+    )
+  endif()
 
   set(CPACK_BUNDLE_NAME ${PROJECT_NAME})
   set(CPACK_GENERATOR "DragNDrop") #;productbuild")
diff --git a/misc/ExportOptions.plist b/misc/ExportOptions.plist
new file mode 100644
index 00000000..fd0a2ca2
--- /dev/null
+++ b/misc/ExportOptions.plist
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>destination</key>
+	<string>export</string>
+	<key>method</key>
+	<string>developer-id</string>
+	<key>signingCertificate</key>
+	<string>Developer ID Application</string>
+	<key>signingStyle</key>
+	<string>manual</string>
+</dict>
+</plist>
diff --git a/release/build-mac.sh b/release/build-mac.sh
index 405c2da1..b8e6616a 100755
--- a/release/build-mac.sh
+++ b/release/build-mac.sh
@@ -1,58 +1,62 @@
 #!/bin/sh -e
+set -x
+
+do_openssl_arch()
+{
+  arch="$1"
+  openssl="openssl-1.1.1q"
+  test -f "$openssl".tar.gz || curl -O https://www.openssl.org/source/"$openssl".tar.gz
+  if ! test -d "${openssl}-${arch}"; then
+    tar zxf "$openssl".tar.gz
+    mv "$openssl" "${openssl}-${arch}"
+  fi
+  (cd ${openssl}-${arch}
+   ./Configure darwin64-${arch}-cc shared \
+	--prefix="${INSTALL_DIR}-${arch}" \
+	-mmacosx-version-min="$SDK"
+   make -j $JOBS build_libs && make install_dev
+  )
+}
 
 do_openssl()
 {
-set -x
-read openssl < "`dirname $0`/../OpenSSL.version"
-test -f "$openssl".tar.gz || curl https://www.openssl.org/source/"$openssl".tar.gz > "$openssl".tar.gz
-tar zxf "$openssl".tar.gz
-(cd $openssl
- ./Configure darwin64-x86_64-cc shared --prefix=$INSTALL_DIR $CFLAGS
- #./config shared --prefix=$INSTALL_DIR
- make && make install_sw
-)
-chmod 755 $INSTALL_DIR/lib/*.dylib
+  mkdir -p ${INSTALL_DIR}/lib
+  do_openssl_arch x86_64
+  do_openssl_arch arm64
+
+  lipo -create ${INSTALL_DIR}-*/lib/libcrypto.*.dylib -output ${INSTALL_DIR}/lib/libcrypto.1.1.dylib
+  lipo -create ${INSTALL_DIR}-*/lib/libssl.*.dylib -output ${INSTALL_DIR}/lib/libssl.1.1.dylib
+  cp -a ${INSTALL_DIR}-arm64/include ${INSTALL_DIR}
+  ln -s libcrypto.1.1.dylib ${INSTALL_DIR}/lib/libcrypto.dylib
+  ln -s libssl.1.1.dylib ${INSTALL_DIR}/lib/libssl.dylib
+
+#  chmod 755 $INSTALL_DIR/lib/*.dylib
 }
 
-do_libtool()
-{(
-read libtool < "`dirname $0`/../Libtool.version"
-test -f "$libtool".tar.gz || curl http://ftp.gnu.org/gnu/libtool/"$libtool".tar.gz > "$libtool".tar.gz
-tar zxf "$libtool".tar.gz
-cd "$libtool"
-#export CFLAGS="-arch i386"
-./configure --prefix ${INSTALL_DIR}
-make && make install
-)}
+XCA_DIR="$(cd `dirname $0`/.. && pwd)"
+TOP_DIR="`dirname $XCA_DIR`"
 
-XCA_DIR="`dirname $0`"
-XCA_DIR="`cd $XCA_DIR/.. && pwd`"
+BUILDDIR="$TOP_DIR/osx-release"
 
-# define the installation dir and the path to the new library
-# it will be installed locally in the home directory
-export INSTALL_DIR="`pwd`"/install
-export DYLD_LIBRARY_PATH=$INSTALL_DIR/lib
-export CPPFLAGS="$CPPFLAGS -I${INSTALL_DIR}/include"
-export LDFLAGS="-L${INSTALL_DIR}/lib"
+INSTALL_DIR="$TOP_DIR/install"
+SDK="10.13"
+JOBS=4
+ARCHIVE="xcarch.xcarchive"
+test -x $INSTALL_DIR/lib/libcrypto.dylib || (cd $TOP_DIR && do_openssl )
 
-export CFLAGS="-mmacosx-version-min=10.13"
+cmake -B "$BUILDDIR" "$XCA_DIR" \
+	-DOPENSSL_ROOT_DIR="$INSTALL_DIR" \
+	-DCMAKE_OSX_ARCHITECTURES="arm64;x86_64"
+cmake --build "$BUILDDIR" -j4
 
-if test -f build-libs; then
-  mkdir -p "$INSTALL_DIR"
-  do_libtool
-  do_openssl
-fi
-unset CFLAGS
+echo xcodebuild -scheme package \
+	   -jobs $JOBS \
+	   -configuration Release\
+	   -parallelizeTargets \
+	   -archivePath $ARCHIVE \
+	   CODE_SIGN_IDENTITY="${APPLE_DEVELOPER_HASH}" \
+	   build archive
 
-XCA_DIR="`dirname $0`"
-XCA_DIR="`cd $XCA_DIR/.. && pwd`"
+echo xcodebuild -exportArchive -archivePath "$ARCHIVE" -exportOptionsPlist "$XCA_DIR/misc/ExportOptions.plist" -exportPath Release
 
-XCA_BUILD="xca-macbuild"
-#rm -rf "$XCA_BUILD"
-mkdir -p "$XCA_BUILD"
-cd "$XCA_BUILD"
-
-(cd $XCA_DIR && ./bootstrap)
-$XCA_DIR/configure --with-macos-version=10.13 --with-openssl="$INSTALL_DIR"
-make -j5
-cp *.dmg ..
+#/usr/bin/ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
diff --git a/release/release.txt b/release/release.txt
index 89e8af82..ab5af52e 100644
--- a/release/release.txt
+++ b/release/release.txt
@@ -19,7 +19,7 @@ https://developer.apple.com/documentation/xcode/notarizing_macos_software_before
 
 DMG=xca-2.4.0-High-Sierra.dmg
 
-xcrun altool --notarize-app --primary-bundle-id "de.hohnstaedt.xca.dmg" --username "christian@hohnstaedt.de" --password "@keychain:AC_PASSWORD" --asc-provider HWR8GSJ73M --file "$DMG"
+xcrun notarytool submit "$DMG" --keychain-profile "AC_PASSWORD" --key-id HWR8GSJ73M --wait --webhook "https://example.com/notarization"
 
 xcrun stapler staple "$DMG"