Skip to main content

Adapting to Apple's TLS Server Certificate Validity Limits

What

This article provides guidance on adapting to Apple's updated398-day policylimit regardingcovers the

Apple devices enforce a maximum allowed398-day lifetimeslifetime offor TLSpublicly server certificates. Effective from September 1, 2020, 00:00 GMT/UTC, TLS server certificates must have a validity period no greater than 398 days. This policy, part of Apple's efforts to enhance web security, affectstrusted TLS server certificates issued fromon Rootor CAsafter September 1, 2020. The rule applies to certificates that chain to root certificate authorities preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS. It does not apply to certificates issued by an administrator-added or private root CA.

When/Why

What

The policy is critical forFileWave administrators usingshould check

Review the public TLS certificate used by FileWave toServer manageand any other HTTPS service that managed Apple devices.devices Itmust ensuresreach. thatA devicepublicly profilestrusted and their associated TLS server certificates complycertificate with thea newlifetime securitybeyond standards.Apple's Non-compliance results in network and application failures, andlimit can preventbe websitesrejected, fromwhich loadingcan oninterrupt affectedenrollment, Applecheck-in, devices.downloads, or browser access.

How

Renewal checklist

To comply with Apple's policy:

  1. Certificate Issuance and Renewal: Certificates should be issued with a maximum validity of 397 days to avoid edge case issues.
  2. Check Existing Certificates: Certificates issued before September 1, 2020, are not affected by this change. However, their renewal must comply with the 398-day limit.
  3. ProfileCheck Deploymentthe intrust FileWavechain: EnsureApply allthe TLS398-day rule to publicly trusted server certificatescertificates. embeddedPrivate inor profilesadministrator-added forroot AppleCAs are outside this specific limit, but devices meetmust thesestill validitytrust requirements.their full certificate chain.
  4. Monitoring and Planning: Regularly monitor certificate expiration dates and plan renewals accordingly.

Related Links

links

Digging

Verify Deeper

after renewal

ThisAfter policy shift reflectsreplacing a broadercertificate, moveverify towardsits enhancing digital securityissue and trustworthinessexpiration indates, onlinehostname environments.coverage, Byand reducingfull certificatechain lifetimes,from an Apple aimsdevice. toThen mitigateconfirm risksthat suchFileWave asenrollment, certificateclient compromisecheck-in, and mis-issuance.downloads Forstill FileWavework users,through adaptingthe torenewed theseHTTPS new requirements is essential for maintaining secure, reliable, and compliant management of Apple devices across various environments.endpoint.

Back to top