Adapting to Apple's TLS Server Certificate Validity Limits

What Apple's 398-day limit covers
Apple devices enforce a maximum 398-day lifetime for publicly trusted TLS server certificates issued on or after September 1, 2020. The rule applies to certificates that chain to root certificate authorities preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS. It does not apply to certificates issued by an administrator-added or private root CA.
What FileWave administrators should check
Review the public TLS certificate used by FileWave Server and any other HTTPS service that managed Apple devices must reach. A publicly trusted certificate with a lifetime beyond Apple's limit can be rejected, which can interrupt enrollment, check-in, downloads, or browser access.
Renewal checklist
To comply with Apple's policy:
Certificate Issuance and Renewal: Certificates should be issued with a maximum validity of 397 days to avoid edge case issues.
Check Existing Certificates: Certificates issued before September 1, 2020, are not affected by this change. However, their renewal must comply with the 398-day limit.
Check the trust chain: Apply the 398-day rule to publicly trusted server certificates. Private or administrator-added root CAs are outside this specific limit, but devices must still trust their full certificate chain.
Monitoring and Planning: Regularly monitor certificate expiration dates and plan renewals accordingly.
Related links
Apple's Certificate Policy Announcement - Details on the TLS server certificate validity limit.
RFC 5280, Section 4.1.2.5 - Reference for certificate validity period definition.
Verify after renewal
After replacing a certificate, verify its issue and expiration dates, hostname coverage, and full chain from an Apple device. Then confirm that FileWave enrollment, client check-in, and downloads still work through the renewed HTTPS endpoint.