Apple Push Notification Service
What
- Like to know a new message has been sent?
- Want to see how many messages are unread from the Home Screen, per App?
TheQuick followinganswer: APNs is reallythe justApple service FileWave uses to wake Apple devices for information,MDM/DDM describingcheck-ins. APNs.The device still contacts the FileWave server for the actual management commands; APNs only delivers the wake-up notification.
Push Notificationsnotifications areallow mostly designedapps to allow 3rd party Apps the ability to informnotify users throughwith their App, e.g. messages,alerts, sounds, etc.badges, someor relevantsilent detail.updates. Users control which messages are silenced or visible and how theynotifications are visible throughor silenced in Settings.
Developers of Appsapps requiringthat thisuse serviceAPNs register their Appapp with Apple.Apple and This process requires an APNs token, integrated intointegrate the App’s Server.
Generation of an APNs token itselfinto istheir aapp requiredserver.
FileWave Adminsadministrators generate the APNs token as perpart of the otherApple KBMDM articlessetup covered in thisthe chapter.related certificate articles.
For APNs to succeed,work, the Appapp and 3rd third-party server must be able to trust Apple’s APNs Cloudservice. Service.Their trust Hence, Trust Storesstores must include Apple’sthe current Apple APNs Rootroot Certificate.certificate.
APNs Certificate Update:
At times the Root Certificate used by APNs will require replacing, prior to expiry.
|
APNs Cert |
Service |
Up to Date |
From Date |
Expiry Date |
|
AAA Certificate Services root certificate |
Sandbox |
Jan 2025 |
- |
Dec 31 23:59:59 2028 GMT |
|
Production |
Feb 2025 |
- |
||
|
SHA-2 Root : USERTrust RSA Certification Authority certificate |
Sandbox |
- |
Jan 2025 |
Jan 18 23:59:59 2038 GMT
|
|
Production |
- |
Feb 2025 |
Apple will supply information when this occurs, ensuring developers of Apps and providers of 3rd party servers update their products.
FileWave Server already includes both of the above listed certificates within its Trust Store.
3rdThird-party Party Appsapps
The act of installingInstalling an Appapp requiringthat APNs,requires APNs registers that Appapp with APNsAPNs, and the device receives a Uniqueunique Devicedevice Token.token for that app.
Messages pushed can include:
- Display Alert Message to User
- Apply Badge Icon to App’s Icon
- Play a Sound
- Deliver Notification Silently
Both Message and Unique Device Token are sent by the App’s Server when attempting to initiate a notification.
Notifications are relayed through Apple’s APNs service. When Onthe receiptdevice ofreceives the notification, it acts according to the devicepayload, willsuch actas accordingly, e.g. displaydisplaying a message to the user.
In essence, the message payload therefore consists of:
- APS Dictionary: Message content
- Alert Keys: Assist notification processing, e.g. an identifier to a particular conversation of a messaging app.
- Device ID: Unique Device Token
The App should contain the current APNs Root Certificate within its Trust Store
MDM/DDM
MDM and DDM communication also reliesrely uponon theAPNs, APNswith servicea andfew thereforeimportant isdifferences anfrom exampleuser-facing ofapp this process, but key aspects are:notifications:
- The act of enrolment is equivalent to installing the App, initiating the receipt of the Unique Device Token.
- The App in question is a binary, included in the Operating System by Apple: '/usr/libexec/mdmclient'.
- APS dictionary should not be included in the payload from an MDM server.
MDM APNs messages are nothing more thanonly a request for the device to contact the MDM server. Any commandsCommands are subsequently sent directly to the device, oncebetween the device responds back toand the MDM server fromafter thisthe APNsdevice request.checks in.
Since Apple are the developers of the 'mdmclient', Apple manage its Trust Store. Apple’s list of supported Root Certificates per OS version are available from their KB: