Renew APNs (Apple Push Notification Service) Certificate
The Apple Push Notification service (APNs) certificate enables secure communication between the MDM server and managed Apple devices. This document outlines the steps to renew an expired or revoked APNs certificate to ensure uninterrupted device management.
The importance of renewing the APNs certificate
- If the APNs certificate expires, Apple devices can no longer be managed.
- Renewing the certificate restores management capabilities without requiring device re-enrollment.
- Recommended Action: Renew and upload the new certificate at least one month before expiry to ensure all devices receive the update in time.
Note: 1. Always use a Shared corporate Apple ID (not a personal one) for APNs certificate management.
2. If renewed just before expiry, devices will apply the update only after contacting the MDM server.
Renewing of APNs certificate involves three key stages:
- Review the APNs certificate expiry date
- Download the vendor signed CSR (Certificate Signing Request)
- Renewing and uploading the new APNs certificate
Review the APNs certificate expiry date
To verify when the current APNs certificate expires:
- On the MDM Console, Navigate to Enrollment -> APNs Certificate
- The Renew APNs Certificate button appears 1 month before expiry.
- You will receive an email reminder from Apple and ManageEngine at your registered address, notifying you: 'Your Apple Push Services certificate will expire in 30 days.
Notes: If the certificate expires, enrolled devices will lose connection to the MDM server. Renew the certificate before expiration to maintain uninterrupted device management.
Download the vendor signed CSR (Certificate Signing Request)
To download the vendor signed CSR (Certificate Signing Request):
- In the MDM console, navigate to Enrollment → APNs Certificate
- Click Renew APNs Certificate (available 1 month before expiry)
- Download the Vendor Signed CSR.
Renewing and uploading the new APNs certificate
- Access the Apple Push Certificates Portal.
- Log in using the same shared corporate Apple ID used when first creating the certificate. You have not remember the id you used to create the apns certificate, you can view it on the MDM console->APNs Certificate. This email address we keep here for an easy reference.
Note: Note: If you're unable to find the APNs certificate or access your Apple ID, refer to our troubleshooting guide for APNs Renewal. - Locate your expiring certificate by matching the UID (verify this matches the UID shown in the MDM console)
- Select Renew Certificate and accept the terms and conditions.
- Upload the Vendor Signed CSR file you downloaded earlier.
- Download the new certificate file: MDM_ZOHO_Corporation_Certificate.pem
- Return to MDM console, Select the downloaded .pem file and Click Upload to complete the process.
Your APNs certificate is now successfully renewed, allowing continued management of all Apple devices without requiring re-enrollment.
Note: The Apple Push Notification Service (APNs) certificate will be shared across all customers in the MSP environment.
APNs Certificate Migration Between Apple IDs
You may need to transfer the APNs certificate to a new Apple ID for below mentioned criteria:
- The original Apple ID credentials are no longer accessible.
- Your organization needs to change the certificate's ownership.
- You're consolidating MDM management under a different Apple ID
To transfer your APNs certificate to a new Apple ID:
- Fetch the Required Information from the MDM console:
- Certificate Name
- Certificate UID
- Serial Number
- Expiry Date
- Original Apple ID
- Contact Apple Developer Program Support:
- Submit a support ticket through the Apple Developer Portal.
- Provide all the above collected certificate details and request to migrate the APNs certificate to a new Apple ID.
1. Certificate Validity: The migration process maintains your existing certificate's expiration date.
2. Device Impact: No re-enrollment of managed devices is required
Modify Apple Id in MDM console
While creating the APNs certificate we request to enter the email address used to create the APNs certificate. We keep this email address for your easy reference. If you are migrating your APNs certificate from one account to another account, we recommend you to update the email address in the MDM console as well for your future reference.
Note: Modifying this email address will not migrate your apns account.
To modify the apns email address on the mdm console, navigate to enrollment->APNs certificate. here you can see the APNs details. click on the "Modify apple Id" and update the email address.