Apple Push Notification Service

To manage Apple devices such as iPhones, iPads, Macs, iPods, Apple TVs etc, in the MDM Console, you need to configure an Apple Push Notification Service (APNs) certificate. An Apple Push Notification Service (APNs) certificate is a security credential provided by Apple that allows Mobile Device Manager Plus (MDM) server to communicate with Apple devices (iOS, macOS, iPadOS, etc.) securely. The APNs certificate establishes the MDM server's credibility with the Apple Push Notification Service (APNs), which acts as an initial relay between the server and Apple devices. This allows the MDM server to send push notifications for various tasks, including onboarding or enrolling Apple devices, updating configurations, installing apps, or executing remote commands.

Note: APNs certificates are valid for one year and must be renewed annually to maintain functionality.

Enroll Apple Devices in MDM

Below is a step-by-step explanation of the process, including a diagram for visual reference.

Steps to Create and Upload an Apple Push Notification Service Certificate

1. Navigate to Enrollment->APNs Certificate in MDM Console. Click on "Get Started" to begin the process. Download the Vendor-signed (VendorSignedCSR.plist) CSR(Certificate Signing Request) file. This CSR is signed by ManageEngine and is required to create the APNs certificate in the Apple Push Notification portal.

   

   Note: If you are using the on-premise version on MDM or Endpoint Central and mdm.manageengine.com.au is not accessible, a ManualCSR file will be generated. To obtain the VendorSignedCSR file, ensure the URL is accessible and retry, or contact MDM support via email to request the VendorSignedCSR file.

2. Access the Apple Push Certificate Portal and login using an Apple ID created with a shared email address (e.g., admin@zylker.com), which should serve as a common team account rather than being tied to an individual, to avoid complications like certificate renewal issues if an employee leaves the organization—create one Apple Account if needed.
3. After logging in, click on 'Create a Certificate' and follow the on-screen instructions to upload the Vendor-signed CSR file to generate the APNs certificate, download the file (.pem/.crt/.cer). This file need to be uploaded in the MDM Console.

   

4. Navigate to the MDM console and Upload the downloaded APNs certificate file. Enter the Corporate Apple ID used to create the APNs certificate. Provide the Organization Name.
   • Add the corporate admin email address(es) in the "Email notification for APNs expiry" field. You can add multiple email addresses. Notifications about APNs expiry will be sent to these email addresses.
   • Click "Upload". You will see a confirmation message: "APNs Certificate uploaded successfully!" on the MDM console.

   

5. You can either enroll Apple devices immediately by clicking "Enroll Now" or view the APNs certificate details by selecting "Later". If you are using On-Premise, then you can ensure the certificate is functioning correctly using the "Verify APNs connectivity" option.

1. APNs Validity: The APNs certificate is valid for one year from the date of creation. Ensure you renew it before expiration to avoid service disruption. Renew the APNs certificate at least 2-3 weeks before expiration to avoid service disruption.
2. Corporate Apple ID: Always use the same corporate Apple ID for renewing the APNs certificate. Using a different Apple ID will require re-enrolling all managed devices.
3. Email Notifications: Configure email notifications for APNs expiry to stay informed about renewal deadlines.

Steps to Remove an APNs Certificate in ME MDM

Pre-requisites

1. De-provision all Apple devices before removing the APNs certificate.
2. Remove all ABM/ASM servers from the MDM Console.
3. If using the MSP version, ensure that Apple devices and ABM/ASM servers are removed from all customer accounts.

Impact of Removal: You will not be able to manage any Apple devices until a new APNs certificate is uploaded.

Steps to Remove APNs Certificate:

• Navigate to Enrollment->APNs Certificate in MDM Console.
• Click Remove APNs. Confirm the removal.

Troubleshooting Tips

APNs Certificate Expired: Renew the APNs certificate by following the steps outlined in the Renew APNs Guide.

Push Notifications Not Working:Verify the APNs certificate is correctly uploaded in ME MDM. For On-Premise setups, verify connectivity to ensure proper communication. Ensure the certificate is not expired. Check the Apple Developer Portal for any issues with the certificate.