Apple Push Notification Service

What

• Like to know a new message has been sent?
• Want to see how many messages are unread from the Home Screen, per App?

APNs is the Apple service FileWave uses to wake Apple devices for MDM/DDM check-ins. The device still contacts the FileWave server for the actual management commands; APNs only delivers the wake-up notification.

Push notifications allow apps to notify users with alerts, sounds, badges, or silent updates. Users control which notifications are visible or silenced in Settings.

Developers of apps that use APNs register their app with Apple and integrate the APNs token into their app server.

FileWave administrators obtain and renew an APNs certificate for Apple MDM; this is not an app's device token or one of the trusted root certificates listed below. Follow APNs certificate creation and renewal with XCA, or the linked Keychain and Windows alternatives. For renewal, use the Apple Account that owns the existing certificate and renew that certificate with the same topic. Updating an APNs root certificate does not renew your organization's MDM certificate.

For APNs to work, the app and third-party server must trust Apple’s APNs service. Their trust stores must include the current Apple APNs root certificate.

APNs Certificate Update:

At times the Root Certificate used by APNs will require replacing, prior to expiry.

Apple will supply information when this occurs, ensuring developers of Apps and providers of 3rd party servers update their products.

FileWave Server already includes both of the above listed certificates within its Trust Store.

Third-party apps

An app registers with APNs when it runs and receives a device token unique to that app on that device. It forwards the token to its provider server so the server can address notifications to it. Installation alone is not the registration step; see Apple's app registration guidance.

Messages pushed can include:

• Display Alert Message to User
• Apply Badge Icon to App’s Icon
• Play a Sound
• Deliver Notification Silently

Both Message and Unique Device Token are sent by the App’s Server when attempting to initiate a notification.

Notifications are relayed through Apple’s APNs service. When the device receives the notification, it acts according to the payload, such as displaying a message to the user.

An app notification request includes a device token to identify the destination and a JSON payload for the notification content. The device token is sent in the request path, not as a field inside the APS dictionary; see Apple's notification request format. The main pieces are:

• APS Dictionary: Message content
• Alert Keys: Assist notification processing, e.g. an identifier to a particular conversation of a messaging app.
• Destination: the unique app/device token in the request path

The App should contain the current APNs Root Certificate within its Trust Store

MDM/DDM

MDM and DDM communication also rely on APNs, with a few important differences from user-facing app notifications:

• The act of enrolment is equivalent to installing the App, initiating the receipt of the Unique Device Token.
• The App in question is a binary, included in the Operating System by Apple: '/usr/libexec/mdmclient'.
• APS dictionary should not be included in the payload from an MDM server.

MDM APNs messages are only a request for the device to contact the MDM server. Commands are sent directly between the device and the MDM server after the device checks in.

Since Apple are the developers of the 'mdmclient', Apple manage its Trust Store.  Apple’s list of supported Root Certificates per OS version are available from their KB:

https://support.apple.com/en-gb/103272